PMO Security/Obsolescence

Project overview

We are looking for a Security/Obsolescence PMO for a 3-month renewable mission in Niort.

Context and Reporting

The Project Management Officer (PMO) for the "IT Obsolescence" portfolio reports to the Head of Business Relationship and IT Coordination within the IT Department. They also functionally report to the Head of Operational Cybersecurity and Digital Resilience for portfolio operational monitoring.

They work transversally with various departments, IT departments, application managers, infrastructure teams, security, architecture, purchasing, and suppliers to organize and secure the handling of IT system obsolescence and monitor the IT security plan.

They act as the coordination point for the portfolios. They consolidate the obsolescence view, structure decision-making, monitor roadmap execution, and ensure reliable information for governance bodies.

____

Main Missions:

Pilot and coordinate the "IT Obsolescence" portfolio and the "Security" portfolio to sustainably reduce the IT system's exposure to risks related to end-of-support components, technologies, versions, hardware, software, and services, or those insufficiently maintained or no longer meeting expected standards.

Ensure a consolidated, prioritized, and shared view of obsolescences, their impacts, treatment plans, dependencies, resources, budgets, and residual risks.

Contribute to the control of digital risks and IT system resilience by facilitating decisions, securing remediation paths, and measuring portfolio progress.

Define and maintain the portfolio governance framework: scope, responsibilities, bodies, management rules, entry and exit criteria, milestones, and expected deliverables.

Organize and lead steering committees, operational reviews, and arbitration meetings with stakeholders.

Prepare decision-making documents and record arbitrations, commitments, alerts, and decisions made.

Ensure the alignment of the portfolio with other IT roadmaps, business projects, architectural strategy, and risk management plans.

Consolidate the inventory of affected components and ensure the quality, completeness, and up-to-dateness of monitoring data.

Define a consistent qualification method, including business criticality, exposure level, vendor or manufacturer support status, vulnerabilities, dependencies, treatment complexity, and budget constraints.

Build and maintain a shared prioritization for treatments to be undertaken.

Identify situations without a clear path, risks of support interruption, critical dependencies, and escalation needs.

Develop the multi-year obsolescence treatment roadmap and ensure its operational deployment.

Coordinate action plans led by project managers, application managers, product managers, or infrastructure managers.

Track milestones, deliverables, workloads, budgets, dependencies, risks, and blocking points.

Propose necessary corrective measures in case of deviations and organize required arbitrations.

Ensure traceability of decisions, waivers, risk acceptances, and target treatment dates.

Design and maintain the portfolio dashboard and monitoring, risk, and performance indicators.

Produce a regular summary presenting progress, trends, variances, alerts, expected decisions, and residual risks.

Adapt the reporting level to different bodies: operational steering, IT management, business departments, and risk governance.

Ensure clear, factual, and consistent communication to all stakeholders.

Unite contributors around shared objectives, responsibilities, and deadlines.

Facilitate coordination between operations, infrastructure, applications, architecture, cybersecurity, purchasing, finance, business units, partners, and suppliers.

Ensure anticipation of consultations, renewals, migrations, technical capabilities, and necessary resources.

Support action plan managers in formalizing realistic and secure trajectories.

Contribute to the assessment and monitoring of risks associated with obsolescences, as well as the definition of compensatory measures when immediate treatment is not possible.

Ensure the portfolio's consistency with internal policies, security, continuity, and digital resilience requirements, as well as applicable regulatory and normative requirements.

Capitalize on lessons learned, audits, incidents, and encountered difficulties to improve the monitoring system.

Propose evolutions of processes, tools, indicators, and governance to industrialize the detection and treatment of obsolescences.

Deliverables Expected Content

• Governance and Structuring of Portfolios
• Mapping, Qualification, and Prioritization of Obsolescences
• Development and Monitoring of Roadmaps
• Reporting, Indicators, and Communication
• Stakeholder Coordination
• Risk Management, Compliance, and Continuous Improvement
• Portfolio Repository: Consolidated inventory, responsible parties, criticality, support status, risks, trajectories, and target dates.
• Roadmaps: Multi-year plan and annual breakdown of treatments, milestones, priorities, dependencies, workloads, and budgets.
• Dashboards: Progress, coverage, exposure, deviation, risk, and data quality indicators.
• Arbitration Files: Scenarios, impacts, costs, risks, recommendations, and expected decisions.
• Tracking Register: Actions, alerts, decisions, waivers, risk acceptances, and compensatory measures.
• Governance Summaries: Reporting adapted to operational, steering, and management committees.

Project details

• Start: 2026-10-26
• Duration: 3 mois (renouvelables)
• Location: 79 - Niort, FR
• Languages: French