Director, Cloud Assurance

DUTIES & RESPONSIBILITIES Cloud & AI Security Strategy, Governance & Advisory • Security Strategy & Roadmap: Develop China Agentic Cloud security strategy and roadmap recommendations based on Global security policies, China DSO requirements for AI governance and data security, applicable Chinese regulatory requirements, and the need to respond to major security threats. • Control Framework & Assurance Model: Establish and continuously improve the China Agentic Cloud control framework and assurance mechanisms, defining security objectives, key initiatives, and control priorities. • Security Advisory: Provide security analysis and expert advice for Landing Zone, multi-cloud platforms, shared cloud services, MaaS, Agentic AI, and major cloud scenarios. • Leadership Reporting: Regularly report to the China Cloud Lead on security posture, major risks, control gaps, remediation progress, and capability needs, and recommend risk treatment and resource investment. Global Security Policy Implementation, Control Framework & Security Architecture Assurance • Policy Translation: Interpret and analyze Global security policies, standards, and requirements applicable to China Agentic Cloud, and translate them into applicable control requirements. • Local Requirements Integration: Incorporate applicable Chinese regulatory requirements, China DSO requirements for AI governance and data security, and major threat response needs into the control framework. • Control Domains & Minimum Requirements: Define control objectives and minimum requirements across network security, identity and access management, data protection, key management, logging and auditing, workloads, PaaS, MaaS, models, and Agents. • Security Architecture Principles & Guardrails: Define China Agentic Cloud security architecture principles, mandatory security requirements, and the control objectives and acceptance criteria for Security Guardrails. • Security Design Review: Conduct security design reviews for Landing Zone, cloud platforms, MaaS, Agentic AI, cloud migration, third-party access, and major changes. Recommend security improvements where gaps exist, and work with the Agentic Cloud Platform Architecture & Engineering Lead to assess practical approaches for implementing the requirements. Control Implementation Oversight & Platform Collaboration • Requirements to Engineering: Work closely with the Agentic Cloud Platform Architecture & Engineering Lead to translate applicable security requirements into platform architecture standards, engineering controls, Security Guardrails, and operational practices. • Implementation Assessment: Assess whether technical control implementation designs adequately meet the defined control objectives and security requirements. • Engineered Enforcement: Partner with the Agentic Cloud Platform Architecture & Engineering Lead to drive the engineered implementation of security requirements through Landing Zone, Infrastructure as Code (IaC), Policy as Code, standard templates, and Production Readiness Criteria. • Control Monitoring: Monitor the implementation progress, coverage, and operating effectiveness of key controls based on implementation and operational information provided by the platform. • Gap & Deviation Management: Analyze technical constraints, implementation deviations, and control gaps, and agree on remediation plans, alternative approaches, or compensating controls with the Agentic Cloud Platform Architecture & Engineering Lead. • Responsibility Boundaries: Define control responsibility boundaries between the platform layer and the cloud-hosted system or workload layer. • Prioritization Advice: Advise the China Cloud Lead on control implementation priorities, security capability gaps, and improvement plans. Continuous Security Assurance & Control Effectiveness • Risk-Based Assurance: Establish a risk-driven continuous Security Assurance mechanism, prioritizing work based on platform criticality, data sensitivity, applicable Chinese regulatory requirements, and major threats. • Validation Mechanisms: Work with Agentic Cloud Validation to establish and continuously improve operating mechanisms for day-to-day CSPM management, external attack surface security validation, penetration testing of cloud-hosted systems, and AI red teaming, defining scope, control standards, deliverables, and issue closure requirements. • Assurance Conclusions: Consolidate platform control implementation information, security validation results from Agentic Cloud Validation, and relevant audit information to evaluate the coverage and ongoing effectiveness of key controls, producing assurance conclusions and a remediation status view. • Remediation Effectiveness: Track the remediation of significant issues, evaluate remediation effectiveness based on retest results from Agentic Cloud Validation or other appropriate evidence, and drive continuous improvement of control requirements and assurance mechanisms. • MLPS Assessment Support: Based on control implementation and validation results, support China DSO in Multi-Level Protection Scheme (MLPS) assessments related to China Agentic Cloud, including control status analysis, evaluation of assessment findings, remediation tracking, and coordination of validation results. Security Compliance • Compliance Mapping: Work closely with Global Security, China DSO, and China Compliance to map applicable Global security policies and data security, AI governance, and security compliance requirements to the China Agentic Cloud control framework, and drive their implementation. • Regulatory Activities: Support MLPS assessments, security filings, and other related activities led by China DSO, coordinating architecture descriptions, control information, and validation evidence, and tracking remediation of related findings. • Audit & Evidence Management: Support internal audits, external audits, compliance inspections, and assessments related to China Agen