Head, Cloud Security

**Job Summary**
- If you are not an engineer, cannot code, and are unable to motivate the organisation on the benefits of cloud, this role is not for you.
The role is responsible for conducting security assessments, audits, post-incident reviews to ensure the organisation’s cloud infrastructure is resilient and prepared for future risks. The role fosters a collaborative approach to security, ensuring that both technical teams, security teams, risk and business stakeholder are aligned in maintaining a secure cloud environment.**Key Responsibilities**

**Strategy**
- Define and execute a comprehensive cloud security strategy that aligns with organization goals and regulatory requirements
- Regularly review and update security strategies and practices based on emerging threats, industry trends, and organizational changes

**Business**
- Be responsible for the security of the cloud platform and take personal responsibility
- Design and maintain a secure cloud architecture, integrating best practices and technologies to protect against threats.
- Work with security architecture to define the platform security controls
- Develop threat models and controls to protect the cloud platform
- Implement preventive controls on the cloud platform across AWS & Azure on pipelines, account baselines and policy configurations
- Implement detective & corrective controls on the cloud platform across AWS & Azure
- Ensure continuous monitoring and enhancement of the cloud security posture, implementing best practices and proactive measures to safeguard against evolving threats
- Lead the response to security incidents, conducting investigations, and implementing remediation measures to prevent recurrence.
- Assess the security posture of cloud service providers and third-party vendors, ensuring they meet the organization’s security requirements
- Integrate security practices into the cloud development and deployment pipelines, ensuring that security is embedded throughout the software lifecycle

**Processes**
- Work with Technology Governance to issue appropriate policies, procedures and quality checks for operating and servicing cloud workloads across the bank
- Enable governance of ICS controls on the cloud platform and integrate seamlessly with cyber security processes and controls
- Have awareness of and understand the relevant regulation for the markets in which the bank operates such as sovereignty and resilience.
- Ensure compliance with Standard Chartered governance frameworks and challenge them where appropriate.
- Keep program management teams in-tune with statuses and risks during change delivery

**Skills and Experience**

**People & Talent**
- The leader is an engineer at heart and keeps a lean, motivated and highly skilled team of cloud engineers that together are obsessed with customer (internal or external) needs
- The team believes and advocates efficiency as a continuous engineering challenge not a commercial ambition
- Drives a deep sense of entrepreneurialism into the team to endlessly pursue opportunities with the cloud for the bank
- The team of talented engineers has it drilled into them that their success also pivots on the ability for other engineers to deploy workloads on the cloud platform easily and seamlessly
- Be an inspiration to other engineers attracting and developing new talent to the organisation and managing poor performers
- Keep a list of practical yet challenging objectives and measures for the team and individuals to target
- Promote a culture of security awareness within the organization by providing training and resources to educate staff on cloud security practices and policies

**Risk Management**
- Comply with organisation risk management framework
- Identify, assess, and mitigate security risks, ensuring compliance with industry standards and regulations.
- Work closely with risk counterparts across technology, cyber and other areas for safe deployment of workloads to cloud
- Drive for the closure of risks, operational events and audit findings on time, once and done

**Governance**
- Establish governance frameworks for cloud security and provide regular reports to senior management on security metrics, incidents, and improvements.
- Ensure compliance with all applicable SC governance frameworks
- Adhere to and optimise cloud governance frameworks and processes
- Stay aware of changing regulatory landscape so that we can proactively manage the emerging requirements for workloads
- Ensure compliance with the highest standards of regulatory and business conduct and compliance practices as defined by internal and external requirements. This includes compliance with local banking laws and anti-money laundering regulations and guidelines

**Regulatory Business Conduct**
- Display exemplary conduct and live by the Group’s Values and Code of Conduct.
- Responsibility for building a culture of good Conduct within the team.
- Take personal responsibility for embedding the highest standa