INFORMATION SECURITY EXPERT – VENDOR RISK & SECURITY DUE DILIGENCE

About the company

EPSA is a European group specializing in performance. We optimize the financial, operational, and sustainable results of our clients.

Recognized for our technical know-how and the diversity of our business expertise. Our solutions platform is built around procurement performance, innovation financing, and the energy and environmental transition.

Present in about forty countries, with 3,200 committed employees and a net turnover of €500M, we are the reference partner for any organization wishing to improve its productivity and profitability.

Driven by an entrepreneurial spirit and a desire for positive impact, we rely on the diversity of our expertise to strengthen performance.

Your tasks

• Supporting the financial performance of companies by optimizing all social and tax charges, supporting innovation financing, searching for subsidies, or managing financial risks.
• Operational support for all key functions or company transformation projects: Procurement, Digital & IT, Operations & Supply Chain, Transformation.
• Strengthening cost-saving searches (costs, process optimization...) by providing our best experts or relevant outsourcing solutions.

Finally, we know how to meet environmental performance challenges, ranging from ESG regulatory dimensions, energy performance plans, or sustainable mobility, to the definition and implementation of true CSR, climate, or decarbonization strategies.

CONTEXT Mission within the Security in Projects team of the Group Operations Department of a large international insurance group (Risk & Cyber Centre of Expertise). The team ensures vendor risk management and security due diligence, so that security remains relevant, cost-controlled, and aligned with the Group's security strategy and Security by Design best practices.

• Perform security due diligence within the vendor risk framework
• Support quality control of Information Security (IS) and Operational Risk (OR) vendor assessments
• Contribute to the preparation of Vendor Risk Committees (VRC)
• Identify and analyze product, project, and vendor risks, recommend mitigation options, and document them in language understandable by the business

DELIVERABLES

• Documented vendor risk assessments (risks, mitigation recommendations, justification)
• Quality control deliverables for IS and OR assessments
• Documentation and support materials for VRC preparation
• Security due diligence reports on the vendor risk framework
• Structured risk registers (product, project, vendor)

Requirements

• Level: experienced
• More than 5 years of experience in information security, cyber risk analysis, vendor assessment, Cloud architecture, IT audit, or a related field
• Fluent English (B2+ minimum), both written and spoken

REQUIRED SKILLS (mandatory)

• Cyber risk threat analysis
• Vendor assessment
• Security risk analysis methodology
• Ability to analyze complex business and IT scenarios
• Writing structured deliverables explaining the Security by Design framework and its benefits to both business and technical audiences
• Experience in project and budget contexts
• Ability to coordinate business and technical stakeholders

CERTIFICATIONS

• Mandatory: ISO 27001 (Lead Auditor) and ISO 27005, or equivalent
• Preferred: CISSP, CISSP-ISSAP, CISM, GIAC
• Preferred: business continuity certification (MBCI, DRII, or equivalent)

Other

CONDITIONS

• Location: Paris 17e (France), nearshoring possible
• Duration: 45 days (360 hours), at 8 h/day
• Start date: as soon as possible, at the beginning of the month
• Travel: none
• Status: employee or freelance