VOC and Remediation Governance Referent

Project overview

Our client in the Retail sector is looking for a VOC and Remediation Governance Referent M/F

Mission Description:

Context

Within an IT department and its security service, the position is part of a business continuity and vulnerability management context. The role consists of pragmatically assessing cyber threats and orchestrating remediation with operational teams without paralyzing the business. It involves contextualizing vulnerabilities according to business stakes and asset criticality, while supporting technical teams in their action plans.

Mission

The VOC referent drives governance and remediation processes, assesses and prioritizes cyber risks based on business context, and supervises vulnerability detection activities. They facilitate cooperation between business, IT, DevOps, and security teams to ensure pragmatic vulnerability treatment.

Main Responsibilities

Technical Environment

Expected Deliverables

Candidate Profile

Experience

Technical Skills

Personal Skills

Languages

Essential Skills / Qualities:

Vulnerability and remediation management, Cyber risk management and security governance, VMDR platforms and vulnerability prioritization, Automation of remediation workflows, Jira and ITSM solutions, Professional English

• Develop and track a detailed schedule integrating critical milestones and deadlines.
• Produce and track remediation action plans, risk analyses, mitigation plans, progress reports, and recommendations for management.
• Define and maintain remediation processes, vulnerability management lifecycles, and risk management processes in line with the PSSI (Information Security Policy).
• Prepare and lead periodic remediation committees with operational departments and application managers; contribute to risk committees, application release committees, and CAB (Change Advisory Board).
• Define, analyze, and utilize dashboards and key performance indicators adapted to different audiences.
• Assess the impact of vulnerabilities on vital processes, particularly financial, regulatory, reputational, supply chain, and service continuity impacts.
• Prioritize remediations by balancing security urgency and operational constraints, such as peak activity periods, maintenance windows, and availability requirements.
• Process requests for derogation or temporary risk acceptance with business units and the CISO, and recommend palliative measures.
• Supervise the configuration and coverage of VMDR platform assets (cloud, on-premise, workstations, and network), as well as the cleanup of false positives.
• Correlate detected vulnerabilities with current threats, including CISA KEV, active exploits, ransomware campaigns, Zero-Day alerts, and EPSS.
• Facilitate collaboration between business teams and IT/DevOps operations teams.
• Advise administrators and developers on patch application, version upgrades, and compensatory configurations (hardening, firewalling rules, WAF, and segmentation).
• Understand and implement automated remediation workflows, particularly for patch deployment and updates.
• Vulnerability Management: VOC, VMDR, CVSS v3/v4, CISA KEV, EPSS
• Frameworks and Methods: ISO 27001, ISO 27005, EBIOS RM, NIST, CIS Benchmarks, MITRE ATT&CK, PSSI
• Systems and Infrastructures: Windows, Linux, Active Directory, Azure, AWS, virtualization, databases, networks
• Tools and Security: Jira, ITSM, ticketing, DevOps, SOC, ROC, WAF, firewalling
• Governance: KPI, risk committees, CAB, application release committees
• Detailed schedule with critical milestones and deadlines
• Tracking of vulnerabilities and associated action plans for the information system
• Risk analyses and mitigation plans
• Progress reports, management recommendations, and dashboards with key indicators
• Remediation and risk management processes and policies
• Remediation workflows, including automated ones
• 7 to 10 years of experience ideally combining operational technical experience (SOC, VOC, ROC, system/network administration, or pentest) with a progression towards risk management or security governance.
• Master's degree (Bac+5) from an engineering school, in cybersecurity, IT, or risk management.
• Mastery of IT risk management and security frameworks: ISO 27001/27005, EBIOS RM, NIST, CIS Benchmarks, MITRE ATT&CK, and CVSS v3/v4.
• Good understanding of enterprise IT architectures, particularly Windows/Linux, Active Directory, Azure/AWS, virtualization, databases, and networks.
• Mastery of a VMDR platform and vulnerability management.
• Knowledge of ITSM and ticketing solutions, particularly Jira, and automation of remediation workflows.
• Ability to contextualize cyber risks in relation to business stakes and to arbitrate remediation priorities.
• Ability to support technical teams and communicate with systems, network, SECOPS, DEVOPS, and DBA engineers.
• Aptitude for facilitating cooperation between business and IT teams.
• Professional English.

Nice to have

soft skills +

Project details

Yes — 2 days/week

Candidate Profile

• Vulnerability and remediation management
• Cyber risk management and security governance
• VMDR platforms and vulnerability prioritization
• Automation of remediation workflows
• Jira and ITSM solutions
• Professional English
• Start: 05/11/2026
• Duration: 6 mois renouvelable
• Remote: hybrid
• Location: Paris, France, FR
• Rate: 69-69 EUR/h
• Languages: French