{"id":3445582,"url":"https://alion.io/job/astrazeneca-director-cloud-assurance","title":"Director, Cloud Assurance","company":{"id":13195,"name":"AstraZeneca","domain":"astrazeneca.com","url":"https://alion.io/company/astra-zeneca","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":94,"open_postings":171,"ghost_share":0.006,"stale_share":0.374,"repost_share":0.099,"time_to_fill_p50_days":19,"computed_at":"2026-11-06T05:58:05Z"}},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["China"],"countries":["CN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":55000,"max_usd":124000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":4188},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"NIST CSF","optional":false},{"name":"Red Teaming","optional":false}],"status":"live","first_seen_at":"2026-10-29T07:53:08Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-11-06T03:33:39Z","board_verified":true,"closed_at":null,"days_open":7,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":7},"description":"DUTIES & RESPONSIBILITIES\nCloud & AI Security Strategy, Governance & Advisory\nSecurity Strategy & Roadmap: Develop China Agentic Cloud security strategy and roadmap recommendations based on Global security policies, China DSO requirements for AI governance and data security, applicable Chinese regulatory requirements, and the need to respond to major security threats. \nControl Framework & Assurance Model: Establish and continuously improve the China Agentic Cloud control framework and assurance mechanisms, defining security objectives, key initiatives, and control priorities. \nSecurity Advisory: Provide security analysis and expert advice for Landing Zone, multi-cloud platforms, shared cloud services, MaaS, Agentic AI, and major cloud scenarios. \nLeadership Reporting: Regularly report to the China Cloud Lead on security posture, major risks, control gaps, remediation progress, and capability needs, and recommend risk treatment and resource investment. \nGlobal Security Policy Implementation, Control Framework & Security Architecture Assurance\nPolicy Translation: Interpret and analyze Global security policies, standards, and requirements applicable to China Agentic Cloud, and translate them into applicable control requirements. \nLocal Requirements Integration: Incorporate applicable Chinese regulatory requirements, China DSO requirements for AI governance and data security, and major threat response needs into the control framework. \nControl Domains & Minimum Requirements: Define control objectives and minimum requirements across network security, identity and access management, data protection, key management, logging and auditing, workloads, PaaS, MaaS, models, and Agents. \nSecurity Architecture Principles & Guardrails: Define China Agentic Cloud security architecture principles, mandatory security requirements, and the control objectives and acceptance criteria for Security Guardrails. \nSecurity Design Review: Conduct security design reviews for Landing Zone, cloud platforms, MaaS, Agentic AI, cloud migration, third-party access, and major changes. Recommend security improvements where gaps exist, and work with the Agentic Cloud Platform Architecture & Engineering Lead to assess practical approaches for implementing the requirements. \nControl Implementation Oversight & Platform Collaboration\nRequirements to Engineering: Work closely with the Agentic Cloud Platform Architecture & Engineering Lead to translate applicable security requirements into platform architecture standards, engineering controls, Security Guardrails, and operational practices. \nImplementation Assessment: Assess whether technical control implementation designs adequately meet the defined control objectives and security requirements. \n Engineered Enforcement: Partner with the Agentic Cloud Platform Architecture & Engineering Lead to drive the engineered implementation of security requirements through Landing Zone, Infrastructure as Code (IaC), Policy as Code, standard templates, and Production Readiness Criteria. \nControl Monitoring: Monitor the implementation progress, coverage, and operating effectiveness of key controls based on implementation and operational information provided by the platform. \nGap & Deviation Management: Analyze technical constraints, implementation deviations, and control gaps, and agree on remediation plans, alternative approaches, or compensating controls with the Agentic Cloud Platform Architecture & Engineering Lead. \nResponsibility Boundaries: Define control responsibility boundaries between the platform layer and the cloud-hosted system or workload layer. \nPrioritization Advice: Advise the China Cloud Lead on control implementation priorities, security capability gaps, and improvement plans. \nContinuous Security Assurance & Control Effectiveness\nRisk-Based Assurance: Establish a risk-driven continuous Security Assurance mechanism, prioritizing work based on platform criticality, data sensitivity, applicable Chinese regulatory requirements, and major threats. \nValidation Mechanisms: Work with Agentic Cloud Validation to establish and continuously improve operating mechanisms for day-to-day CSPM management, external attack surface security validation, penetration testing of cloud-hosted systems, and AI red teaming, defining scope, control standards, deliverables, and issue closure requirements. \nAssurance Conclusions: Consolidate platform control implementation information, security validation results from Agentic Cloud Validation, and relevant audit information to evaluate the coverage and ongoing effectiveness of key controls, producing assurance conclusions and a remediation status view. \nRemediation Effectiveness: Track the remediation of significant issues, evaluate remediation effectiveness based on retest results from Agentic Cloud Validation or other appropriate evidence, and drive continuous improvement of control requirements and assurance mechanisms. \n MLPS Assessment Support: Based on control implementation and validation results, support China DSO in Multi-Level Protection Scheme (MLPS) assessments related to China Agentic Cloud, including control status analysis, evaluation of assessment findings, remediation tracking, and coordination of validation results. \nSecurity Compliance\nCompliance Mapping: Work closely with Global Security, China DSO, and China Compliance to map applicable Global security policies and data security, AI governance, and security compliance requirements to the China Agentic Cloud control framework, and drive their implementation. \nRegulatory Activities: Support MLPS assessments, security filings, and other related activities led by China DSO, coordinating architecture descriptions, control information, and validation evidence, and tracking remediation of related findings. \nAudit & Evidence Management: Support internal audits, external audits, compliance inspections, and assessments related to China Agentic Cloud; coordinate evidence and review its quality, ensuring responsible parties provide complete, accurate, consistent, and traceable materials. \nGlobal Alignment: Communicate with Global Security on the local implementation of Global security policies and on the onboarding, coverage, and use of Global security tools in the China Agentic Cloud environment. \nJOB REQUIREMENTS & COMPETENCIES\nJob requirements\nAcademic / Professional qualification\nBachelor’s degree or above in Computer Science, Information Security, Software Engineering, or a related discipline; \nRecognized security, cloud, or audit certifications preferred, such as CISSP, CISM, CISA, CCSP, CCSK, ISO/IEC 27001 Lead Auditor / Lead Implementer, or professional-level cloud security certifications from major cloud providers (AWS / Alibaba Cloud). \nTechnical / skill training\nIn-depth knowledge of cloud security architecture and controls, including network security, identity and access management, data protection, key management, logging and auditing, workload and PaaS security, and Landing Zone design. \nSolid understanding of AI and Agentic AI security and governance, including MaaS, model and Agent security risks, AI red teaming, and AI governance frameworks (e.g., NIST AI RMF, ISO/IEC 42001). \nStrong knowledge of security control frameworks and assurance methodologies (e.g., ISO/IEC 27001/27017/27018, NIST CSF, CSA CCM), and of applicable Chinese regulatory requirements, including MLPS 2.0, the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, and generative AI regulations. \nWorking knowledge of engineered control implementation and monitoring, including Infrastructure as Code (IaC), Policy as Code, Security Guardrails, CSPM, and continuous control monitoring. \nWorking experience:\nEssential\n10+ years of experience in information security, cloud security, or IT risk and assurance, including at least 5 years in cloud security architecture, governance, or assurance in large enterprise or multi-cloud environments. \nProven experience building and operating security control frameworks and assurance mechanisms, translating global security policies and regulatory requirements into actionable and verifiable controls. \nHands-on experience in security architecture and design reviews for cloud platforms, Landing Zones, cloud migrations, third-party access, and major changes. \nTrack record of leading or supporting MLPS assessments, security filings, internal and external audits, and remediation programs in China. \nDesirable\nExperience in security assurance or governance for AI platforms, MaaS, or Agentic AI applications. \nExperience in regulated industries (e.g., pharmaceutical or life sciences), including familiarity with GxP and data integrity requirements. \nExperience working in a global matrix organization, aligning local implementation with Global security policies, standards, and tools. \nLanguage ability\nFluent in written and spoken English and Mandarin Chinese, with the ability to collaborate with Global Security, present security insights and risk recommendations to senior leadership, and prepare English reports and assessment materials. \nOthers\nStrong strategic thinking and risk-based judgment, with the ability to translate complex security risks into clear insights and decision-making recommendations for senior leadership. \nExcellent stakeholder management and influencing skills, with the ability to drive control implementation and remediation across platform, engineering, compliance, and global teams without direct authority. \nHigh integrity, strong accountability, and an objective, evidence-based mindset, with continuous passion for emerging cloud and AI security domains. \nDate Posted\n29-10月-2026Closing Date\n30-12月-2026AstraZeneca embraces diversity and equality of opportunity. We are committed to building an inclusive and diverse team representing all backgrounds, with as wide a range of perspectives as possible, and harnessing industry-leading skills. We believe that the more inclusive we are, the better our work will be. We welcome and consider applications to join our team from all qualified candidates, regardless of their characteristics. We comply with all applicable laws and regulations on non-discrimination in employment (and recruitment), as well as work authorization and employment eligibility verification requirements.","description_format":"text","description_chars":10353,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":true}]},"benefits":[],"hiring_locations":[{"name":"China","iso":"CN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Prescription Drugs","Oncology Therapeutics","Rare Disease Therapeutics","Cardiometabolic Therapeutics"],"lifecycle":[{"event":"open","at":"2026-10-29T07:53:08Z"}],"visa":[],"liveness":{"score":81,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":0.9,"age_days":7,"expected_fill_days":19,"reasons":["conf:2","velocity","win:mid","comp:brand"],"computed_at":"2026-11-06T05:58:05Z"},"pay":null,"html_url":"https://alion.io/job/astrazeneca-director-cloud-assurance","json_url":"https://alion.io/job/astrazeneca-director-cloud-assurance.json","meta":{"generated_at":"2026-11-06T07:13:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12777,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":13195},"rest":"https://alion.io/mcp/rest/get_company?id=13195"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fastrazeneca-director-cloud-assurance"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fastrazeneca-director-cloud-assurance"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fastrazeneca-director-cloud-assurance"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/astrazeneca-director-cloud-assurance\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fastrazeneca-director-cloud-assurance"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3445582}},{"tool":"search_jobs","arguments":{"company":"astrazeneca.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3445582},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}