Business Continuity and Risk Analyst

Keystone Solutions; Namen; Sur place; EUR 70 000 - 110 000; Plein temps

Résumé du poste

Keystone Solutions is seeking a consultant to evaluate, prioritize, and track cyber risks related to industrial systems and their IT dependencies present on public infrastructures managed by our client. This on-site assignment requires representing Keystone Solutions while addressing diverse challenges in a dynamic environment.

The role emphasizes rigorous risk assessment, CMDB mapping, and creation of a risk reduction roadmap, with a focus on OT/IT convergence, SOC integration, and disaster

Qualifications

• English language at beginner level (A1) mandatory; French at professional proficiency (C2) required.

Responsabilités

• Map OT assets and IT dependencies in a unified CMDB; identify SPOFs such as Domain Controller and critical links.
• Perform operational risk analysis using SPW methodology to model threats and impacts.
• Develop a prioritised treatment plan with a 24-month roadmap and cost/impact estimates.
• Draft IT/OT security clauses in specifications and verify critical OT suppliers' compliance.
• Translate OT risks into logging requirements and detection rules for the SPW SOC.
• Participate in restoration tests and tabletop exercises for continuity planning (PCA/DRP).
• Maintain OT risk register and provide summaries for Cyber MI Committee and NIS2 audits.

Connaissances

Communication & influence

Industrial protocol knowledge

SCADA/PLC/RTU/DCS knowledge

Cybersecurity frameworks

Risk management methodologies

IEC 62443 familiarity

GRC tools

Outils

GRC tools

Description du poste

Mission Overview:

Keystone Solutions is seeking a consultant to evaluate, prioritize, and track cyber risks related to industrial systems and their IT dependencies present on public infrastructures managed by our client. This consultancy mission will involve working on-site and representing Keystone Solutions while addressing various challenges in a dynamic environment.

Key Activities:

• Mapping & Inventory: Identify OT assets (PLC, RTU, HMI, field networks) and their IT dependencies in a unified CMDB. Identify SPOFs: Domain Controller, inter-network links, critical markets, firewalls, etc.
• Operational Risk Analysis: Apply the SPW methodology to model threats (tunnel shutdown, dam overflow, etc.), vulnerabilities, and impacts (safety of people, environment, availability, finances, image, etc.). Use concrete scenarios based on the SPW crisis experience from 2025.
• Treatment Plan & Prioritization: Develop an implementation plan for actions to address analyzed risks (reduction, avoidance, transfer, acceptance). Estimate cost/impact and create a risk reduction roadmap aligned with the operational continuity of systems. Communicate the complete risk management cycle.
• Project & Market Integration: Write IT/OT security clauses in specifications. Verify compliance of critical OT suppliers (automation maintenance, supervision).
• IT/OT Synergy & SOC: Translate OT risks into logging requirements and detection rules for the SPW SOC (use-case, automation control, etc.).
• Resilience & Exercises: Participate in restoration tests and OT/IT tabletop exercises to validate impact assumptions. Contribute to lessons learned and analyze root causes. Contribute to the continuous improvement of service continuity plans (PCA) and disaster recovery plans (DRP).
• Reporting & Governance: Maintain the OT risk register, prepare summaries for the Cyber MI Committee and for NIS2 audits (risk management policy).

Expected Deliverables:

• Service continuity plan and disaster recovery plan
• Detailed inventory of OT assets & IT dependencies (CMDB)
• OT risk register with scoring, scenarios, owners, and deadlines
• Mapping of zones & conduits + flow diagrams
• Prioritized treatment plan (24-month roadmap)
• Security requirement grids for OT purchases/upgrades
• Quarterly reports to the Coordinator: status of risks, progress, decisions to arbitrate

Expected Behavioral Skills:

• Assertiveness and ability to be proactive
• Autonomous but enjoys teamwork
• Excellent communicator, client-oriented and results-driven
• Positive and caring attitude, active listening
• Ability to educate and simplify technical aspects
• Rigorous and methodical

Duration:

03/11/2026 - 14/06/2027 8 months • (full time)

Skills required:

• Communication & influence (vulgarisation pour dirigeants et équipes terrain) - Level: T1 - Junior - Most recent: Any time
• Connaissance des protocoles industriels de communication tels que Modbus, PROFINET, DNP3 ou équivalents.
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Connaissance des systèmes de contrôle-commande tels que les systèmes SCADA, PLC, RTU, DCS ou équivalents.
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Framework de cybersécurité (NIST, Cyberfundamentals)
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Méthodologies de gestion des risques (ISO 27005, IEC 62443-3-2, EBIOS RM)
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Normes et référentiels de sécurité de l’information (IEC 62443)
• (mandatory) - Level: T1 - Junior - Most recent: Any time
• Outils GRC & reporting
• (mandatory) - Level: T1 - Junior - Most recent: Any time

Language requirements:

• English
• (mandatory)
• Level Beginners (A1)
• French
• (mandatory)
• Level Proficiency (C2)