Chief Information Security Officer (CISO) M/F

Your tasks

1. Mission

In a context of strong growth, internationalization, and development through external growth, EDL is strengthening its cybersecurity governance and is looking for its Chief Information Security Officer (CISO).

Reporting to the Management, the CISO defines and drives the Group's cybersecurity strategy, in alignment with EDL's business, regulatory, and technological challenges.

He/she is the guarantor of the confidentiality, integrity, and availability of systems and data, particularly in a highly sensitive environment related to health data and solutions.

The CISO plays a transversal role, at the interface between Management, IT, R&D, Product, HR, Legal teams, and the various entities of the Group.

2. Main Responsibilities

Define and drive the cybersecurity strategy

• Define the Group's cybersecurity strategy, policy, and roadmap.
• Identify and prioritize key cyber risks based on business challenges.
• Define security policies, standards, and rules applicable to all entities.
• Build and monitor cybersecurity performance and maturity indicators.
• Regularly present risks, incidents, and action plans to Management and governance bodies.

Governance, risk, and compliance

• Drive the Information Security Management System (ISMS) and contribute to the certification and maintenance of ISO 27001, ISO 9001 certifications.
• Organize risk analyses and drive associated treatment plans.
• Ensure regulatory and normative monitoring: NIS2, GDPR, requirements related to the health sector, ISO 27001, etc.
• Define and maintain security policies and procedures.
• Drive internal and external audits and ensure the follow-up of remediation plans.
• Participate in the security assessment of critical suppliers and partners.

In collaboration with IT and technical teams

• Supervise the implementation of security measures: IAM, MFA, EDR, backups, encryption, network segmentation, vulnerability management, etc.
• Define security requirements for infrastructure, applications, and cloud environments.
• Drive vulnerability management and the follow-up of their remediation.
• Define and test Business Continuity / Disaster Recovery mechanisms.
• Supervise security incident management and coordinate the response to major incidents.
• Regularly organize cyber crisis exercises.

Product and development security Given EDL's activity, the CISO works closely with the Product and R&D teams to integrate security from the design stage:

• Define security requirements applicable to products and projects.
• Promote a Security by Design / Privacy by Design approach.
• Participate in securing the software development lifecycle.
• Supervise or coordinate penetration tests, security audits, and architecture reviews.
• Support teams in managing product vulnerabilities.
• Contribute to managing client security requirements and responding to security questionnaires.

Awareness and cybersecurity culture The CISO is also responsible for developing a true security culture within the Group:

• Define and deploy the annual cybersecurity awareness program.
• Organize training and phishing/awareness campaigns.
• Adapt actions to different audiences: employees, managers, technical teams, and executives.
• Develop security reflexes in daily practices.

Acquisitions and Group transformation As part of external growth operations and the integration of new entities:

• Perform cyber due diligence on acquired companies.
• Evaluate risks, compliance gaps, and maturity levels of integrated entities.
• Define security and integration plans.
• Gradually harmonize the Group's security policies, tools, and standards.
• Support IT transformation projects and system migrations.

Requirements

3. Profile sought

With higher education in computer science, cybersecurity, information systems, or equivalent, you have 8 to 12 years of experience, including significant experience in a cybersecurity responsibility role.

Ideally, you have evolved in an environment that is

• international and multi-site;
• in strong growth or transformation;
• subject to strong security and compliance requirements;
• ideally in the health, software, SaaS sectors, or in a regulated environment.

You particularly master

• ISO 27001 / ISO 9001 frameworks;
• cyber risk analysis and management;
• IS security governance;
• incident management and business continuity;
• cloud architectures and associated security challenges;
• IAM, MFA, EDR, backup, encryption, and vulnerability management principles;
• application security and DevSecOps principles;
• GDPR and, ideally, NIS2 issues.

An ISO 27001 Lead Implementer / Lead Auditor, CISSP, CISM or equivalent certification would be a plus.

4. Skills and personal qualities

Beyond technical expertise, we are looking for a profile capable of transforming cyber challenges into business decisions.

• Strong capacity for analysis and prioritization.
• Excellent understanding of risk and governance issues.
• Ability to work with both technical interlocutors and a Management Committee.
• Transversal leadership and ability to influence.
• Pedagogical skills and excellent interpersonal skills.
• Autonomy, pragmatism, and a sense of responsibility.
• Ability to evolve in a building environment with a high level of transformation.
• Fluent professional English.

What we offer

5. What we offer

Joining EDL means joining a fast-growing Group at the heart of the digital transformation of the health sector.

The position offers high Group exposure and the possibility to build and structure the cybersecurity function in an international environment, notably by supporting:

• the rapid growth of the Group;
• its international development;
• its external growth operations;
• the increase in maturity of its cyber governance;
• its certification and compliance challenges;
• the securing of critical software solutions for the health sector.

A strategic, transversal, and high-impact role, at the heart of EDL's trust and growth challenges.

Other

Reporting line: General Management Scope: EDL Group – France & international Location: EDL Headquarters – occasional travel to be expected Status: Executive / CDI