Luis Andrés Gonzalez – GNP Seguros

GNP Seguros is one of Mexico’s largest insurance providers, headquartered in Mexico City. Founded in 1901, the company offers various insurance products, including life, health, auto, and property insurance. As a leader in the Mexican insurance market, GNP Seguros is committed to innovation, customer-centric solutions, and long-term sustainability. At the heart of the company’s cybersecurity efforts is its Chief Information Security Officer, Luis Andres Gonzalez, who brings a wealth of experience and a thoughtful approach to balancing security and innovation.

Luis Andrés Gonzalez | GNP Seguros | Chief Information Security Officer, Director

Gonzalez’s journey into cybersecurity began with a childhood curiosity about technology. Growing up, he was fascinated by video games and his family’s first home computer, an Intel 386. His curiosity evolved into a passion for understanding how technology works, which he later formalized through computer systems engineering and information security degrees. Over time, this interest transformed into a career spanning 15 years in cybersecurity, including roles in banking, fintech, and the insurance sector for the past six years. Since July 2023, Gonzalez has served as GNP Seguros’ CISO, leading the company’s efforts to safeguard critical assets and stay ahead of evolving threats.

Gonzalez describes his role as balancing adopting cutting-edge technology and ensuring the business is ready to embrace change.

“It requires a strategic approach,” he says.

His process starts with aligning technology initiatives with the company’s goals, conducting risk assessments, and introducing new technologies incrementally to minimize disruption. He emphasizes the importance of collaboration with business leaders and continuous monitoring of newly implemented technologies to ensure they remain aligned with business needs. One of his key initiatives has been the Crown Jewels Identification program, which identifies and protects the company’s most critical technological assets. This risk-based approach ensures that resources are directed toward the areas that matter most.

Protecting data and information

Under Gonzalez’s leadership, GNP Seguros has developed a multi-layered cybersecurity program to protect its customers and critical assets. The program includes strict access controls, supply chain security measures, and a robust incident response plan regularly tested through simulations. The company also leverages artificial intelligence to improve its security capabilities, such as data loss prevention and tracking data movement across cloud and endpoint environments.

Security awareness and training are key components of GNP Seguros’ cybersecurity strategy. Gonzalez emphasizes that everyone within the organization has a role in protecting information assets. The company invests in security awareness programs for all employees and offers specialized certification programs for its security teams.

“Regular phishing simulations and awareness campaigns further reinforce best practices across the organization,” Gonzalez explains.

Looking ahead, Gonzalez sees AI as both a significant opportunity and a potential risk for cybersecurity. On the positive side, AI can help identify security threats and accelerate investigations, providing real-time insights that enhance the company’s defense capabilities. However, the growing use of AI across various business domains also introduces risks. Gonzalez is focused on implementing a governance framework to ensure AI’s ethical and secure use at GNP Seguros. This includes creating an inventory of AI systems in use, establishing policies aligned with regulatory requirements, and ensuring proper controls for data privacy and model security.

Gonzalez’s perspective on AI extends beyond its immediate benefits to its challenges in the threat landscape. Malicious actors are increasingly using AI to launch sophisticated attacks on cloud infrastructure and supply chains, prompting the need for stronger protective measures like encryption and access management. This evolving landscape has led Gonzalez to broaden the scope of his role, ensuring he stays ahead of AI-related risks while communicating effectively with executive leadership.

Building a team

Gonzalez also prioritizes recruiting and retaining top cybersecurity talent. His team, consisting of 34 subject matter experts, operates within a three-lines-of-defense model to ensure strong governance and oversight. Recognizing the industry-wide talent shortage, GNP Seguros invests heavily in professional development programs to build a pipeline of future cybersecurity leaders. The company fosters a culture of recognition, supports career advancement, and provides mentorship opportunities to ensure employees feel valued and motivated to stay.

“The hardest part of my job,” Gonzalez admits, “is finding the right balance between robust security measures and operational agility.”

His role requires a deep understanding of the business’s specific needs, the customer experience, and ever-evolving cybersecurity regulations. He describes the environment as dynamic and constantly shifting, which demands adaptability and continuous feedback to protect critical assets without hindering business operations.

On the other hand, one of the most rewarding aspects of his work is building strong relationships with his team. Gonzalez takes time to get to know his team members personally and professionally, fostering trust and open communication.

“Empowering people to reach their full potential is incredibly fulfilling,” he says.

Challenges and successes

His career has not been without challenges. One of his biggest obstacles is securing consistent cybersecurity investments from senior management. Building a compelling business case for cybersecurity requires demonstrating how it protects both technological assets and human capital. Gonzalez emphasizes that it’s not just about implementing new security controls—it’s about building a resilient organization capable of adapting to new threats.

Reflecting on his career, Gonzalez shares that cybersecurity incidents have been some of his defining experiences. These incidents often bring unique challenges, requiring a methodical response and recovery approach. He compares the experience to recovering from a car accident, noting that the psychological impact can linger and needs time to overcome. However, each incident has taught him valuable lessons, reinforced the importance of resilience, and strengthened his ability to lead in crises.

Beyond his professional life, Gonzalez has a diverse academic background, including a Systems Engineering degree, a master’s in information security, an MBA, and even undergraduate studies in Psychology. He believes understanding human behavior is crucial to cybersecurity, especially when anticipating how people might interact with technology.

Outside work, he enjoys exploring technology trends, studying psychology, and spending time with his family.

In a world where cyber threats continue to evolve rapidly, Gonzalez’s thoughtful and risk-based approach positions GNP Seguros as a leader in cybersecurity within the insurance sector. By combining technical expertise with a human-centered approach, he is protecting the company’s critical assets and cultivating a security-conscious culture that will serve the organization well into the future.