Expert Consultant in Operational Cybersecurity and Resilience

Project overview

Our client in the Energy and Natural Resources sector is looking for an expert consultant in operational cybersecurity and resilience (M/F).

Mission Description:

Context

The cybersecurity division of an IT department is strengthening its operational resilience capabilities to respond to evolving cyber threats, regulatory requirements, and business continuity challenges. The mission focuses on the preparation, management, and continuous improvement of resilience, crisis management, and business continuity systems. The consultant will collaborate with Digital, Infrastructure, Business, and Cybersecurity teams, as well as with relevant partners and suppliers.

They will also be involved in Critical Asset Resilience (CAR) programs, technical cybersecurity risk analyses, and the evaluation of innovative solutions, particularly in the fields of artificial intelligence, DSPM, AISPM, Shadow IT, and emerging technologies.

Mission

Support teams in preparing and improving operational resilience, business continuity, and Cyber and IT crisis management systems. Provide cross-functional cybersecurity expertise, contribute to risk analyses and strategic projects, and evaluate new security solutions and practices.

Main Responsibilities

Technical Environment

Expected Deliverables

Candidate Profile

Experience

Technical Skills

Personal Skills

Languages

• Participate in Critical Asset Resilience programs, identify critical assets and their dependencies, and contribute to maintaining application and technical mappings.
• Define and improve Business Workarounds, support resilience and business continuity validation exercises, and contribute to the identification and treatment of resilience risks.
• Participate in business continuity initiatives and maintain associated repositories.
• Maintain and improve Cyber and IT crisis management systems; draft and update procedures, guides, and quick reference sheets.
• Prepare, organize, and lead crisis exercises, support teams during real crises or major exercises, conduct post-exercise reviews, and follow up on improvement plans.
• Support Digital, Infrastructure, and Business teams in risk identification and management; conduct or contribute to technical cybersecurity risk analyses.
• Participate in technical reviews, security reviews, and Secure by Design considerations; identify threat scenarios, their impacts, and technical risks associated with architecture evolutions.
• Formulate pragmatic recommendations adapted to business, technical, and regulatory constraints and contribute to security plans.
• Monitor threats, technologies, and innovations; evaluate new solutions and study security challenges related to AI and new digital uses.
• Contribute to discussions and experiments on AISPM, DSPM, Shadow IT and Shadow AI, security posture management, asset discovery, and control automation.
• Provide expertise to IT and Business teams, support strategic projects and IT system transformations, and constructively challenge existing architectures and practices.
• Frameworks and Methods: ISO 27001, ISO 27005, ISO 27035, NIST Cybersecurity Framework, EBIOS Risk Manager
• Resilience and Risk Management: Critical Asset Resilience, Business Continuity, BCP, Business Workarounds, Cyber and IT Crisis Management
• Architecture and Security: Secure by Design, Zero Trust, Defense in Depth, Identity-Centric Security, Vulnerability Management
• Identity and Protocols: SAML, OAuth 2.0, OpenID Connect, LDAP, Active Directory, IAM, PAM, MFA, TLS/SSL, PKI, VPN, DNS, HTTP/HTTPS
• Cloud: AWS, Azure, GCP
• Emerging Technologies: AI security, AISPM, DSPM, Shadow IT, Shadow AI, security automation and orchestration
• Mappings of critical assets and their dependencies
• CAR deliverables and associated improvement plans
• Business Workarounds and business continuity systems
• Technical cybersecurity risk analyses
• Crisis exercise reports and summaries
• Post-exercise reviews and remediation plans
• Security reviews and associated recommendations
• Studies and evaluation reports for innovative solutions
• Decision support documents for IT and cybersecurity managers
• Operational documentation related to resilience and crisis management
• Minimum 8 to 10 years of experience in cybersecurity.
• Significant experience in Cyber and/or IT crisis management, operational resilience and business continuity, as well as in conducting technical cybersecurity risk analyses.
• Experience in complex environments involving multiple stakeholders.
• A major CISSP or CISM certification is expected.
• Expertise in crisis management, operational resilience, business continuity, and cybersecurity risk analysis.
• Mastery or knowledge of ISO 27001, ISO 27005, ISO 27035, NIST Cybersecurity Framework, and EBIOS Risk Manager frameworks.
• Analysis of application, Cloud, and infrastructure architectures, Secure by Design principles, and architecture and security reviews.
• Knowledge of Zero Trust, Defense in Depth, and Identity-Centric Security approaches, as well as vulnerability management.
• Knowledge of identity and security protocols and technologies: SAML, OAuth 2.0, OpenID Connect, LDAP, Active Directory, IAM, PAM, MFA, TLS/SSL, PKI, VPN, DNS, HTTP/HTTPS.
• Knowledge of AWS, Azure, and GCP Cloud environments and security challenges related to AI, AISPM, DSPM, Shadow IT, and Shadow AI.
• Excellent analytical, synthesis, writing, and presentation skills.
• Autonomy, sense of responsibility, critical thinking, pragmatism, and results orientation.
• Ability to simplify complex topics, unite diverse stakeholders, and build consensus between business, technical, and cybersecurity teams.
• Ability to adapt communication to technical audiences and management levels, at strategic, tactical, and operational levels.
• Intellectual curiosity, interest in new technologies, and proactive approach.
• Fluent French.
• Professional English, written and spoken.

Nice to have

Appreciated certifications: EBIOS Risk Manager, ISO 27001 Lead Implementer or Lead Auditor, ISO 27005 Risk Manager, ISO 22301, GIAC certifications, AWS Security Specialty, Microsoft Cybersecurity Architect Expert.

Project details

2 to 3 days of remote work per week.

• Start: flexible
• Remote: hybrid
• Location: 92400 Courbevoie, France, FR
• Rate: 81-81 EUR/h
• Languages: French