Cyber Risk and Information Systems Security Expert (M/F)
About the company
Information systems security has become a major priority for InVivo, especially in the face of new challenges related to cloud and cybersecurity.
As part of the construction of its GRC expertise pool, the InVivo Group is looking for a Cybersecurity GRC Specialist. Reporting functionally to the GRC Team Leader, he/she contributes to the Group's cybersecurity governance, risk management, and compliance. He/she works in close collaboration with the Cybersecurity Director, the GRC Leader, and local teams to strengthen the security and compliance of information systems.
Your tasks
Main Missions
- Cyber risk maturity and management
- Support entities and local SPOCs in improving their cyber maturity.
- Identify, assess, and monitor cyber risks at the Group level.
- Maintain the risk mapping and propose action plans and mitigation measures.
- Assess asset criticality and prioritize security actions.
- Governance and compliance
- Ensure IS compliance with applicable regulations, standards, and frameworks.
- Implement and monitor the controls necessary for compliance.
- Contribute to the construction and evolution of Group security policies, procedures, and frameworks.
- Maintain cyber and regulatory watch on new threats, standards, and requirements.
- Vendor management and audits
- Evaluate the security level of vendors and monitor their security commitments.
- Define the scope and manage cybersecurity audits: scope, coordination, monitoring of deviations, and corrective actions.
- Build and maintain a multi-year audit plan aligned with risks and regulatory requirements.
- Ensure reporting to stakeholders.
- Project security
- Participate in the Group ISP process.
- Integrate security requirements into projects and ensure compliance with security standards.
- Innovation and continuous improvement
- Monitor cybersecurity trends and innovations.
- Identify and recommend actions to continuously improve the Group's security posture.
Additional Missions In support of other Group GRC employees, the Specialist may occasionally contribute to cyber awareness and training for employees, as well as the animation of the Group cybersecurity community: training, webinars, phishing campaigns, events, and sharing best practices.
Requirements
Profile Description You are curious, rigorous, and possess strong analytical and synthesis skills. Your team spirit, ability to work with different departments, dynamism, and tenacity are essential assets for success in this position.
Technical and Functional Skills
- Risk Management: proven experience in cyber risk management, particularly with the EBIOS RM methodology.
- Compliance: good understanding of security regulations, standards, and frameworks (NIS2, ISO 27001/27002, etc.). Analysis: ability to assess a security level, identify risks, and propose appropriate measures.
- Architecture & Security: general understanding of IT/OT architectures and key security controls.
- Communication: excellent written and oral communication skills, with the ability to popularize technical subjects.
- Organization: ability to manage multiple projects and topics simultaneously.
- Knowledge of a GRC tool, particularly TENACY, would be a plus.
Personal Qualities
- Excellent synthesis and communication skills.
- Ability to simplify concepts for non-experts while maintaining technical rigor.
- Service-oriented mindset and ability to support BUs and local teams.
- Proactivity, autonomy, and ability to take initiative.
- Rigor, organizational skills, and respect for deadlines.
- Dynamism and ability to mobilize stakeholders.
- Ease in facilitating workshops, meetings, and risk interviews.
- Team spirit and ability to work with diverse interlocutors.
- Degree: Master's degree (Bac+5) in computer science, risk management, or a related field.
- Experience: minimum 1 year of experience in risk management and compliance, with significant experience in cybersecurity.
- Language: good command of English required in an international context.
Other
Location Paris La Défense - remote work possible 100% on-site for the first 3 months, then 50% remote work possible thereafter.