Security, Vulnerability & Compliance Manager (M/F/D)
2 days ago
Barcelona
ph3Overview /h3pThe Security, Vulnerability Compliance Manager plays a crucial role in safeguarding Allianz Technology’s technology landscape by driving enterprise-wide security, resilience, compliance and governance coordination across CTO2 and multiple Operating Entities (OEs). You will be responsible for managing vulnerability lifecycles, coordinating remediation oversight, tracking compliance against regulatory and internal standards, and presenting risk posture and countermeasures to key stakeholders to support informed, timely and defensible decision-making. The role acts as the operational coordination and governance engine behind complex cross‑functional security and resilience programmes. It ensures visibility, accountability, escalation management, KPI transparency and executive reporting in line with DORA, the Allianz Risk Shield (ARS), Identity Access Management (IAM), the Configuration Management Database (CMDB), Vulnerability Management (AVM), Third Party Risk Management (TPRM), Web Application Firewall (WAF) coverage and broader security governance objectives. You will operate at the intersection of executive communication, programme governance and technical infrastructure strategy – translating complex, high‑volume security data into clear narratives and actionable countermeasures for governance forums, SteerCos and executive leadership across the OE landscape. /ph3Responsibilities /h3ulliCoordinate and govern enterprise‑wide Security Resilience initiatives across CTO2 regions and Operating Entities, applying a proactive “manage by exception” operating model: organise and facilitate recurring governance forums, SteerCos, operational reviews and executive reporting on a defined monthly cadence, maintain governance structures, stage gates, escalation paths, SPOC models and delivery‑tracking mechanisms, ensure action ownership, accountability and follow‑through to agreed deadlines, and support leadership teams in identifying delivery risks, blockers, dependencies, remediation priorities and countermeasures. /liliGovern Allianz Risk Shield (ARS) programme execution across CTO2 environments, including planning, tracking and reporting of compliance progress: monitor self‑attestation, evidence collection, testing progress, control effectiveness and compliance‑score targets, drive remediation and uplift activities required to achieve and sustain those targets, coordinate Service Owners, SPOCs, Information Security Officers and regional stakeholders to maintain momentum, manage escalations relating to unmanaged risks, Archer remediation actions and compliance blockers, and ensure audit readiness, evidence completeness and governance of mitigation actions, reassessments and remediation tracking. /liliOversee the end‑to‑end vulnerability remediation lifecycle across Operating Entities (identification, prioritisation, remediation tracking, verification), track backlog reduction, remediation targets, SLA compliance and KPIs, govern executive reporting for vulnerability management, coordinate enterprise Attack Surface Management (ASM) governance (exposed URLs, internet‑facing applications, cloud exposure, WAF onboarding), govern GitHub Advanced Security, code scanning, repository onboarding and secure‑development remediation tracking, support governance for secure coding, DevSecOps, CI/CD security controls and software supply‑chain security, support risk‑acceptance governance and transparency of legacy or non‑remediable vulnerabilities, and ensure vulnerability dashboards, Power BI metrics and reporting data remain accurate, timely and actionable. /liliDrive enterprise CMDB remediation and data‑quality improvement (CI‑to‑service mapping accuracy, ownership validation, mandatory attribute completion), lead CMDB Quality Management governance across infrastructure, applications and service portfolios, coordinate alignment between CMDB, Service Portfolio Management (SPM), Service Validation and ADO IT structures, support service rationalisation, managed‑service classification and ownership‑alignment exercises, govern remediation of partially managed, unmanaged, deprecated or misaligned service records, coordinate decommissioning governance for obsolete, legacy, redundant or out‑of‑scope services and infrastructure (including exit‑programme and platform‑retirement activities), ensure service inventories and governance reporting remain aligned throughout transformation and exit activities, and track remediation KPIs in alignment with audit and compliance deadlines. /liliManage IAM authorization‑concept completion and governance across in‑scope systems and services, support implementation and tracking of IAM remediation activities and large‑scale remediation programmes, govern reporting of IAM compliance, coverage and progress, support access governance and audit readiness, and coordinate with central IAM, GIAM, Archer and Security teams to align definitions and reporting standards. /liliAdditionally, support governance of Third Party Risk Management (TPRM) initiatives (vendor remediation tracking, service‑mapping activities), Business Continuity Management (BCM) and contractual risk remediation, and coordinate governance and reporting for WAF coverage and DDoS remediation, consolidating security inventories and remediation status across regions. /liliDevelop and maintain executive‑level reporting packs, dashboards and governance materials ensuring accuracy, consistency and quality, standardise KPI definitions, reporting methodologies and data‑quality controls across regions and security domains, steer Power BI dashboard governance and reporting automation (consolidating data from multiple sources into actionable executive insights), produce monthly operational reporting, one‑pagers, management summaries and governance presentations for SteerCo and executive audiences, and act as a trusted coordination point and SPOC between Heads of IT, Security Leads, Service Owners, regional teams and central governance functions, facilitating cross‑functional collaboration across international and matrixed teams and supporting senior leadership decision‑making through accurate, concise and actionable reporting. /liliImprove reporting efficiency through automation, AI‑supported reporting and governance tooling in line with Allianz data‑handling and compliance standards, reduce manual reporting effort through standardisation and process optimisation, introduce scalable governance practices and operational efficiencies, drive continuous improvement of governance operating models, and build strong relationships with regional SPOCs and central programme teams, escalating critical risks and blockers proactively. /li /ulh3Qualifications /h3ulli3+ years of relevant work experience, with strong experience in IT governance, security governance, risk management or operational resilience and demonstrated experience coordinating enterprise‑wide compliance or remediation programmes. /liliHands‑on exposure across several of: DORA, IT risk management, vulnerability management, CMDB governance, IAM/GIAM, security operations governance, audit remediation, service management and operational resilience. /liliExperience with executive reporting and the facilitation of formal governance forums, experience operating across international and matrix organisations as well as project management knowledge alongside analytical thinking, methodological and conceptual skills. /liliSkills in data analysis and reporting, preferably via Excel and Power BI. /liliStrong stakeholder management, escalation management and communication skills. /liliPreferred technical knowledge including: Power BI and reporting automation, Archer (GRC), ServiceNow and CMDB governance, IAM / GIAM concepts and vulnerability management tooling, Dynatrace and GitHub Advanced Security, DORA regulatory framework and broader risk and compliance governance models (e.g. ISO 27001, NIST, EU AI Act, GDPR). /liliFamiliarity with AI technologies and GenAI platforms is a strong advantage. /li /ulh3Benefits /h3ulliHybrid work model with up to 25 days per year working from abroad. /liliCompetitive compensation including a company bonus scheme, pension, employee shares program and multiple employee discounts. /liliCareer development and digital learning programs plus international career mobility and lifelong learning opportunities. /liliFlexible working, health and wellbeing offers (including healthcare and parental leave benefits) to support family and career balance. /li /ulpLocation: Barcelona, Catalonia, ES /ph3Equal Opportunity Statement /h3pAllianz Group is one of the most trusted insurance and asset management companies in the world. We are proud to be an equal opportunity employer and encourage you to bring your whole self to work, no matter where you are from, what you look like, who you love, or what you believe in. We therefore welcome applications regardless of race, ethnicity or cultural background, age, gender, nationality, religion, social class, disability, sexual orientation, or any other characteristics protected under applicable local laws and regulations. /p /p #J-18808-Ljbffr