Principal Information Security Officer

Information Security Officer (ISO 70-80%) 

• Drive the implementation of and ensure compliance with Group-wide standards, regulatory requirements and industry security standards included but not limited to Global information security framework assessment, Global functional rule assessment, DORA, NIS2 in all Allianz Technology services and in projects.  

• Oversee the compliance reporting process for local entities; assess and address deviations from security policies and contractual security provisions, as well as developing effective strategies to mitigate identified information security risks. 

• Lead local Information Security Steering Boards and support preparation of Information Security action plans. 

• Support local executive body in their regulatory Information Security-related governance requirements and their responsibility to set up sound organizational and operational structures and procedures. 

• Implement the actions under the LISO´s responsibility (e. g. IS Management Meetings, ISSB meetings, IS Risk Management), proactively manage the implementation of relevant follow-up measures in a timely manner. 

• Ensure that all Allianz Technology IS Governance related documents are ratified by local entity management and follow up on the implementation of those. 

• Serve as Local contact point for information security-related matters, including interfaces to business, partners, customers and other safeguarding functions. 

• Provide information security consulting and liaison with all relevant stakeholders. 

• Systematically assess the effectiveness of security controls in all services provided by Allianz Technology, its partners and third-party providers. 

• Drive Security Risk Management, including supporting the life cycle of security risk assessments, assessing and addressing deviations from security policies and contractual security provisions, as well as developing effective strategies to mitigate identified information security risks. 

• Ensure that all IS related deviations (aka IS risks) are reported in the GRC tool and managed there as defined in the information security risk management process 

• Promote awareness of Allianz Technology security requirements and processes via regular communication to workforce across multiple channels. 

• Manage the local roll-out of global information security trainings and monitor and report the attendance of local workforce 

• Engage with senior stakeholders and providing regular, high-impact reports to the regional management, the Allianz Technology Thailand Board of Directors, and the Board of Management of Allianz Technology 

• Regularly exchange with and contribute to the regional and global Allianz Technology ISO community. 

• Support the annual IT compliance reporting process for the local entity. 

• Support local management in their regulatory Information Security-related governance requirements. 

Digital Resilience Officer (DRO 20-30% capacity) 

The Digital Resilience Officer (DRO) coordinates the implementation and maintenance of digital resilience and IT risk management for the Allianz Technology branch or local entity. Reports functionally to AZT Head of Digital Resilience and Reports disciplinarily to Head of Branch Operations.   

• Risk & Control Management for Digital Risks  

• Establish and maintain effective digital risk controls, ensuring integration into operational processes  

• Lead digital risk identification, assessment and management across applications and services  

• Ensure digital risks are managed in line with the DIRM framework and monitored within defined timelines within 30 days 

• Participate in the local Risk Council and report on the status of the local digital risks 

• Coordination & Awareness 

• Strengthen digital risk management relationships with customers  

• Act as local coordination point across safeguarding functions  

• Participate in Central DR sessions and engage with global risk communities 

• Third-Party Risk Management (TPRM) 

• Conduct TPRM assessments for all services and contracts 

• Ensure documentation of active contracts in line with DORA requirements 

• Ensure compliance with tiering outcomes and mandatory clauses 

• Maintain D&O trackers 

• Ensure approved exit strategies and validated BCDR plans are in place 

• Reporting & Assurance 

• Coordinate responses to customer audits 

• Support AzTech internal audits relevant for COO function 

• Support Assurance and Risk Shield activities 

• IT Governance & Compliance 

• Ensure ITOM compliance and adherence to regulatory requirements 

• Conduct compliance benchmarking across branches 

• Follow up prior-year risks and ATPIT deviations 

• Deliverables & Timelines 

• Perform annual IT compliance self-assessment (by 30. Sept.) 

• Ensure remediation gaps are logged and tracked (by 30. Nov.) 

• Provide quarterly IT risk reporting to Central