GRC Engineer - M/F

Your tasks

WHAT WE OFFER YOU Under the direct responsibility of the Group Information Security Officer, the GRC Engineer drives the cybersecurity governance, risk management, and compliance process across the Group. Their missions are organized around four axes:

Information Security Governance

• Define, formalize, and maintain the Group's IS security documentation corpus: Security Policy (PSSI), procedures, technical standards, and user charters.
• Participate in the definition of the cybersecurity strategy and in governance bodies (security committees, risk committees).

• Build and monitor the steering indicators (KPI / KRI) of the Group security function.
• Contribute to the cybersecurity communication and awareness plan for business departments and employees.

Cyber Risk Management

• Conduct and maintain the Group's cybersecurity risk mapping according to recognized methodologies (EBIOS Risk Manager, ISO 27005).
• Perform risk analyses on sensitive projects, new applications, and architectural evolutions.

• Monitor risk treatment plans and coordinate the implementation of remediation measures with IT and business teams.
• Evaluate the cybersecurity maturity of the Group and acquired subsidiaries according to recognized frameworks.

Compliance and Certifications

• Drive the Group's compliance with applicable regulatory requirements: NIS2, ISO 27001, ISO 27005, AirCyber, sectoral client requirements (aerospace, defense).
• Prepare and coordinate internal and external audits (certification audits, client audits, regulatory audits).

• Lead the Group's ISO 27001 certification process, in connection with certification bodies and consulting firms.
• Ensure regulatory and normative monitoring and anticipate evolutions impacting the Group (NIS2, RGPD, local laws).

• Interface with the Data Protection Officer and the Legal Department on related topics (data protection, supplier contracts, security clauses).

Supplier and Third-Party Risks

• Define and deploy the cybersecurity assessment process for IT suppliers and third parties (Third Party Risk Management).
• Evaluate the security posture of critical service providers and monitor improvement plans.

• Contribute to the security clauses of supplier contracts in connection with procurement and legal departments.

Requirements

Technical Skills

• Graduate with a Master's degree (engineering school or Master) in computer science, cybersecurity, or an equivalent field.
• You have at least 3 years of experience in governance, risk management, compliance, or cybersecurity topics.
• Good mastery of ISO 27001, ISO 27002, ISO 27005, NIST CSF, NIS2, and RGPD frameworks.
• Experience in supporting an ISO 27001 certification process and in risk analysis (EBIOS RM, ISO 27005…).
• Knowledge of GRC tools (ServiceNow GRC, OneTrust, Eramba, Drata, CISO Assistant, or equivalent) is appreciated.
• A certification (ISO 27001 Lead Implementer/Auditor, CISM, CRISC, EBIOS RM…) is an asset.
• Professional English is essential.

Interpersonal Skills

• Rigorous, organized, and endowed with an excellent analytical mind.
• Capable of interacting with various stakeholders (CIO, business units, management, auditors, suppliers).
• Pedagogical, with a capacity to simplify technical subjects.
• Autonomous, proactive, and comfortable in managing cross-functional projects.
• Recognized for your communication skills and your ability to work in an international environment.

Interpersonal Skills

• Team spirit and sense of service.
• Autonomy and rigor.
• Ability to adapt to various contexts.
• Ease in communicating with both technical and non-technical teams.

What we offer

Why join us?

• Join an international Group in full growth and contribute to the structuring of the GRC function.
• Evolve within a developing team, with strong interactions with the various departments of the Group.