Translate security baseline and the applicable NCA ECC/CCC controls into platform control requirements, and maintain the control-to-evidence mapping.
Review and approve the security design: VPC-SC perimeters, organisation policy residency constraints, CMEK key hierarchy and rotation, Secret Manager usage, private connectivity, egress controls.
Own the data-residency assurance position.
Define PDPL handling for personal data
Review IAM design: AD federation, RBAC/ABAC, privileged access management, segregation of duties, break-glass procedure.
Specify audit logging, retention and SIEM export; verify coverage of data access and change events.
Prepare for the independent penetration: hardening checklist, pre-test review, and coordination of remediation of critical and high findings before acceptance.
Conduct security reviews.
Required skills and experience
8+ years in information security, with 3+ in cloud security architecture.
Direct working knowledge of NCA ECC and CCC, PDPL and SDAIA/NDMO requirements.
GCP security controls in depth: IAM conditions, VPC Service Controls, organisation policy constraints, CMEK/Cloud KMS, Cloud DLP, Assured Workloads concepts, audit logging.
Data protection technique: classification, masking and tokenisation, row- and column-level security models.
Experience preparing an environment for third-party penetration testing and closing findings under time pressure.
Ability to produce compliance evidence that survives a client security function's review.
Certifications
Required: CISSP or CISM.
Preferred: Google Cloud Professional Cloud Security Engineer; ISO/IEC 27001 Lead Implementer or Lead Auditor; CDPSE.
