Director, Cloud Assurance

DUTIES & RESPONSIBILITIES Cloud & AI Security Strategy, Governance & Advisory Security Strategy & Roadmap: Develop China Agentic Cloud security strategy and roadmap recommendations based on Global security policies, China DSO requirements for AI governance and data security, applicable Chinese regulatory requirements, and the need to respond to major security threats. Control Framework & Assurance Model: Establish and continuously improve the China Agentic Cloud control framework and assurance mechanisms, defining security objectives, key initiatives, and control priorities. Security Advisory: Provide security analysis and expert advice for Landing Zone, multi-cloud platforms, shared cloud services, MaaS, Agentic AI, and major cloud scenarios. Leadership Reporting: Regularly report to the China Cloud Lead on security posture, major risks, control gaps, remediation progress, and capability needs, and recommend risk treatment and resource investment. Global Security Policy Implementation, Control Framework & Security Architecture Assurance Policy Translation: Interpret and analyze Global security policies, standards, and requirements applicable to China Agentic Cloud, and translate them into applicable control requirements. Local Requirements Integration: Incorporate applicable Chinese regulatory requirements, China DSO requirements for AI governance and data security, and major threat response needs into the control framework. Control Domains & Minimum Requirements: Define control objectives and minimum requirements across network security, identity and access management, data protection, key management, logging and auditing, workloads, PaaS, MaaS, models, and Agents. Security Architecture Principles & Guardrails: Define China Agentic Cloud security architecture principles, mandatory security requirements, and the control objectives and acceptance criteria for Security Guardrails. Security Design Review: Conduct security design reviews for Landing Zone, cloud platforms, MaaS, Agentic AI, cloud migration, third-party access, and major changes. Recommend security improvements where gaps exist, and work with the Agentic Cloud Platform Architecture & Engineering Lead to assess practical approaches for implementing the requirements. Control Implementation Oversight & Platform Collaboration Requirements to Engineering: Work closely with the Agentic Cloud Platform Architecture & Engineering Lead to translate applicable security requirements into platform architecture standards, engineering controls, Security Guardrails, and operational practices. Implementation Assessment: Assess whether technical control implementation designs adequately meet the defined control objectives and security requirements. Engineered Enforcement: Partner with the Agentic Cloud Platform Architecture & Engineering Lead to drive the engineered implementation of security requirements through Landing Zone, Infrastructure as Code (IaC), Policy as Code, standard templates, and Production Readiness Criteria. Control Monitoring: Monitor the implementation progress, coverage, and operating effectiveness of key controls based on implementation and operational information provided by the platform. Gap & Deviation Management: Analyze technical constraints, implementation deviations, and control gaps, and agree on remediation plans, alternative approaches, or compensating controls with the Agentic Cloud Platform Architecture & Engineering Lead. Responsibility Boundaries: Define control responsibility boundaries between the platform layer and the cloud-hosted system or workload layer. Prioritization Advice: Advise the China Cloud Lead on control implementation priorities, security capability gaps, and improvement plans. Continuous Security Assurance & Control Effectiveness Risk-Based Assurance: Establish a risk-driven continuous Security Assurance mechanism, prioritizing work based on platform criticality, data sensitivity, applicable Chinese regulatory requirements, and major threats. Validation Mechanisms: Work with Agentic Cloud Validation to establish and continuously improve operating mechanisms for day-to-day CSPM management, external attack surface security validation, penetration testing of cloud-hosted systems, and AI red teaming, defining scope, control standards, deliverables, and issue closure requirements. Assurance Conclusions: Consolidate platform control implementation information, security validation results from Agentic Cloud Validation, and relevant audit information to evaluate the coverage and ongoing effectiveness of key controls, producing assurance conclusions and a remediation status view. Remediation Effectiveness: Track the remediation of significant issues, evaluate remediation effectiveness based on retest results from Agentic Cloud Validation or other appropriate evidence, and drive continuous improvement of control requirements and assurance mechanisms. MLPS Assessment Support: Based on control implementation and validation results, support China DSO in Multi-Level Protection Scheme (MLPS) assessments related to China Agentic Cloud, including control status analysis, evaluation of assessment findings, remediation tracking, and coordination of validation results. Security Compliance Compliance Mapping: Work closely with Global Security, China DSO, and China Compliance to map applicable Global security policies and data security, AI governance, and security compliance requirements to the China Agentic Cloud control framework, and drive their implementation. Regulatory Activities: Support MLPS assessments, security filings, and other related activities led by China DSO, coordinating architecture descriptions, control information, and validation evidence, and tracking remediation of related findings. Audit & Evidence Management: Support internal audits, external audits, compliance inspections, and assessments related to China Agentic Cloud; coordinate evidence and review its quality, ensuring responsible parties provide complete, accurate, consistent, and traceable materials. Global Alignment: Communicate with Global Security on the local implementation of Global security policies and on the onboarding, coverage, and use of Global security tools in the China Agentic Cloud environment. JOB REQUIREMENTS & COMPETENCIES Job requirements Academic / Professional qualification Bachelor’s degree or above in Computer Science, Information Security, Software Engineering, or a related discipline; Recognized security, cloud, or audit certifications preferred, such as CISSP, CISM, CISA, CCSP, CCSK, ISO/IEC 27001 Lead Auditor / Lead Implementer, or professional-level cloud security certifications from major cloud providers (AWS / Alibaba Cloud). Technical / skill training In-depth knowledge of cloud security architecture and controls, including network security, identity and access management, data protection, key management, logging and auditing, workload and PaaS security, and Landing Zone design. Solid understanding of AI and Agentic AI security and governance, including MaaS, model and Agent security risks, AI red teaming, and AI governance frameworks (e.g., NIST AI RMF, ISO/IEC 42001). Strong knowledge of security control frameworks and assurance methodologies (e.g., ISO/IEC 27001/27017/27018, NIST CSF, CSA CCM), and of applicable Chinese regulatory requirements, including MLPS 2.0, the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, and generative AI regulations. Working knowledge of engineered control implementation and monitoring, including Infrastructure as Code (IaC), Policy as Code, Security Guardrails, CSPM, and continuous control monitoring. Working experience: Essential 10+ years of experience in information security, cloud security, or IT risk and assurance, including at least 5 years in cloud security architecture, governance, or assurance in large enterprise or multi-cloud environments. Proven experience building and operating security control frameworks and assurance mechanisms, translating global security policies and regulatory requirements into actionable and verifiable controls. Hands-on experience in security architecture and design reviews for cloud platforms, Landing Zones, cloud migrations, third-party access, and major changes. Track record of leading or supporting MLPS assessments, security filings, internal and external audits, and remediation programs in China. Desirable Experience in security assurance or governance for AI platforms, MaaS, or Agentic AI applications. Experience in regulated industries (e.g., pharmaceutical or life sciences), including familiarity with GxP and data integrity requirements. Experience working in a global matrix organization, aligning local implementation with Global security policies, standards, and tools. Language ability Fluent in written and spoken English and Mandarin Chinese, with the ability to collaborate with Global Security, present security insights and risk recommendations to senior leadership, and prepare English reports and assessment materials. Others Strong strategic thinking and risk-based judgment, with the ability to translate complex security risks into clear insights and decision-making recommendations for senior leadership. Excellent stakeholder management and influencing skills, with the ability to drive control implementation and remediation across platform, engineering, compliance, and global teams without direct authority. High integrity, strong accountability, and an objective, evidence-based mindset, with continuous passion for emerging cloud and AI security domains. Date Posted 29-10月-2026 Closing Date 30-12月-2026 AstraZeneca embraces diversity and equality of opportunity. We are committed to building an inclusive and diverse team representing all backgrounds, with as wide a range of perspectives as possible, and harnessing industry-leading skills. We believe that the more inclusive we are, the better our work will be. We welcome and consider applications to join our team from all qualified candidates, regardless of their characteristics. We comply with all applicable laws and regulations on non-discrimination in employment (and recruitment), as well as work authorization and employment eligibility verification requirements.