Consultant Cybersecurity (GRC)

Context

The service is delivered within the Group Operations Security in Projects team. The mission focuses on vendor risk management and security due diligence activities, ensuring that security within Group Operations remains relevant, cost-effective, and delivered in accordance with the Group Security Strategy and Security by Design best practices.

Missions

• Perform security due diligence on vendor risk framework

• Support the Quality Assurance on IS and OR vendor assessments

• Support the preparation of VRC

• Identify and analyze product/project/vendor risks, recommend appropriate mitigation options, and document all components in clear, business-intelligible language

Service Deliverables (but not limited to)

• Documented vendor risk assessments with identified risks, mitigation recommendations, and supporting rationale written in business-intelligible language

• Completed IS and OR vendor assessment quality assurance outputs

• VRC preparation documentation and supporting materials

• Security due diligence reports on vendor risk framework

• Structured risk registers covering product, project, and vendor dimensions

Additional Information

• Sector: Audit / Consulting

• Areas: Design and Maintenance in Operational Condition (MCO), DevSecOps, Data Protection Officer (DPO)

• Languages: French (fluent), English (fluent)

1. Expertise in cyber risk threat analysis, vendor assessment, security, Cloud Architecture and projects, IT audit, or related area
2. Expertise in Security Risk analysis methodology
3. Ability to produce structured written deliverables communicating the Security by Design framework and its benefits to both business and technical audiences
4. Analytical expertise in assessing complex business and IT scenarios
5. Expertise in project and budget management contexts
6. Capacity to engage and coordinate with stakeholders across business and technical levels
7. Information Security and/or Information Technology industry certification: CISSP, CISSP-ISSAP, CISM, ISO 27001 Lead Auditor, ISO 27005, GIAC, or equivalent
8. Business Continuity industry certification: MBCI, DRII, or equivalent
9. Fluent in French and English