Information Security and IT Compliance Officer

Responsibility:

Information Security Representation:

Coordinate and support Scania China management in the implementation of Scania Group Policy 32, Information Security.

Act as the central point of contact for information security matters across Scania China for all internal and external counterparts (e.g., Group Information Security, Scania China IT, Data Protection Organization).

Governance & Policy Management:

Adapt the Information Security strategy and policies specified by Group and China Information Security to the Scania China context.

Propose new Information Security principles, rules and standards to Group/China Information Security when needed.

Maintain local ISMS documentation and manage the policy deviation & exception process, including tracking, impact assessment and periodic review of granted exceptions.

Risk Management:

Support Scania China in identifying, assessing, managing and reporting information security risks with reference to Group and China Information Security policies. (IRAM)

Maintain the local information risk register, drive periodic risk reassessments and track risk treatment plans until closure.

Report on the risk posture, ISec KPIs to local management and Group Information Security on a regular basis.

Regulatory Compliance:

Monitor China regulatory developments relevant to information security and data protection (e.g., CSL, DSL, PIPL) and assess their impact on Scania China.

Conduct compliance gap analyses and coordinate remediation of findings.

Collaborate with Legal, Data Protection and business functions on compliance obligations, including cross-border data transfer topics.

Support third-party / vendor security due diligence and monitor security requirements in supplier contracts.

Deviation & Incident Management:

Support / facilitate Information Security incident handling, Information Security deviations management and Information Security risk acceptance process.

Business Continuity Management:

Support Scania China in IT business continuity management related activities.

Assessment & Audit:

Support Scania China in Information Security related assessments (e.g., Scania Information Security Blue Rating) and audits.

Coordinate internal and external audits, evaluate results, derive corrective measures and monitor their implementation.

Awareness & Training:

Develop, organize and implement the Information Security awareness and training program for all employees in Scania China. (incl. White Collar, Blue Collar, etc.)

Security Operation Support:

Support the China Information Security department in security operation related activities, including but not limited to vulnerability management, incident investigation and security hardening.

Competence:

IT knowledge:

The Person should have at least three years' experience in professional and project-related IT activities.

General information security / IT security:

The Person is familiar with the individual topics of information security and IT security, understands their importance, and knows the protection goals of information security as well as implementation options to strengthen and protect them.

The Person knows the relevant information security processes necessary for the role, including the application, introduction, implementation and improvement of an Information Security Management System (ISMS), and has knowledge of topics such as asset criticality assessment, KPI definition, data classification and information security risk management.

Risk management:

The Person can carry out risk analyses and establish risk assessments for information security risks.

The Person is familiar with mainstream information risk assessment methodologies.

Regulatory & compliance knowledge:

The Person is familiar with Chinese cybersecurity and data protection regulations (e.g., CSL, DSL, PIPL) and their practical application in a corporate environment.

The Person is familiar with Chinese cybersecurity standards.

The Person is familiar with mainstream ISMS frameworks (e.g., ISO 27001, TISAX, etc.)

Project management:

The Person is familiar with project management and can carry out projects according to the process model used in the field.

Language skills:

The Person can communicate and discuss information security issues in English and the local language.

Professional certifications:

CISSP, CISA, CISM and equivalent.