Security Manager / Cybersecurity Expert (Application Portfolio, GRC)

Project overview

Contract role in Niort for a Security Manager/Cybersecurity Expert acting as the security referent for a portfolio of applications and one or more business departments. The mission covers Security-by-Design support to projects and application teams, validation of architecture/technical choices from a cybersecurity perspective, enforcement of group security policies/standards, and end-to-end cyber risk management (risk analyses using EBIOS RM or equivalent, residual risk tracking, compliance support, and decision/arbitration files).

The role also includes third-party/vendor security assessments (including Cloud/SaaS outsourcing risks), governance KPIs, executive reporting to committees, and stakeholder awareness/culture building.

Responsibilities

• In this context, the entity is looking for a Security Manager / Cybersecurity Expert responsible for managing the security of a portfolio of applications and supporting one or more business departments in the control of their cyber risks.
• Acting as a security referent for business departments and application managers.
• Define and promote the security requirements applicable to the application heritage.
• Support projects and application developments in a Security by Design approach.
• Participate in the validation of architecture choices and technical solutions from a cybersecurity perspective.
• Ensure the application of the Group's security policies, standards and best practices.
• Carry out and manage cyber risk analyses of projects and applications according to the methodologies in force (EBIOS RM or equivalent).
• Identify, qualify and monitor residual risks until they are treated or accepted.
• Support the teams in complying with applicable regulatory and normative requirements.
• Participate in risk analyses related to outsourcing and the use of Cloud or SaaS services.
• Produce reports for governance bodies, management committees and risk committees.
• Regularly present the status of risks, vulnerabilities, action plans and compliance of the assets.

Requirements

• Cybersecurity governance and risk management (GRC)
• Application security / application asset security
• Security by Design (integrated into projects and development lifecycle)
• Cyber risk analysis methodology: EBIOS RM (or equivalent)
• Security standards/frameworks knowledge: ISO 27001, NIST, CIS Controls, OWASP
• Architecture and technical solution security review/validation
• Residual risk identification, qualification, tracking and treatment/acceptance workflow
• Regulatory/normative compliance support (interpreting and applying requirements)
• Third-party/vendor security assessment and follow-up of remediation action plans
• Cloud/SaaS/outsourcing risk analysis participation
• Security policies/standards/best practices enforcement
• Governance reporting: KPIs/indicators, risk/vulnerability/action plan reporting to committees
• Strong communication, summarization and presentation to management/risk committees
• Ability to interact with business, IT, risk and management stakeholders
• Autonomous/independent delivery in a multi-stakeholder environment

Project details

• Start: flexible
• Remote: onsite
• Location: France, FR