Cyber GRC Specialist H/F

Sigma; Genf; On-site; CHF 110,000 - 170,000; Full time

Job summary

Sigma Suisse, based in Plan-les-Ouates, seeks a Cyber GRC Specialist to ensure group-wide cyber compliance across affiliates and drive security programs.

This 100% cyber role focuses on governance, risk management and audits in a regulated environment, with travel to sites as needed.

Qualifications

• Minimum 5 years of experience in cybersecurity, auditing, governance and risk management.
• Background in cyber audit or consulting (Big4) with CISO or IT Risk exposure is preferred.
• Strong knowledge of regulatory requirements and standards (NIS2, ISO 27001, NIST CSF).
• Familiar with CIS Controls and NIST SP 800-53.
• Cloud security and third-party risk management are a plus.

Responsibilities

• Ensure compliance with applicable laws, regulations and standards.
• Develop, enforce and update security policies, standards and procedures.
• Monitor and assess adherence to security guidelines across the group.
• Conduct risk assessments, identify vulnerabilities and drive mitigation plans.
• Track risk exposure and report to management on mitigation effectiveness.
• Maintain the information asset inventory and cybersecurity control catalog.
• Lead internal security audits and respond to external audit requests.
• Audit third parties and maintain inventory of approved suppliers and tools.
• Design and run security awareness initiatives, including phishing simulations.
• Work with HR on security aspects of the employee lifecycle.
• Ensure affiliates stay compliant with group policies and travel to sites as needed.

Skills

Cybersecurity

Auditing

Governance

Risk management

NIS2 knowledge

NIST CSF familiarity

ISO 27001 familiarity

Team leadership

Education

CRISC or CISA certification

Job description

Sigma Suisse, based in Plan-les-Ouates, is a recruitment firm specialised in IT and strategic profiles, supporting influential players across French-speaking Switzerland.

Within the IT department, we work on needs in commodity and financial Trading, Pharmaceutical, Aeronautics, Space, Energy, Watchmaking and Swiss foundations.

Cyber GRC Specialist

We are supporting a global player in the search for a Cyber GRC Specialist. This is a 100% cyber role. You will ensure the cyber compliance of the group's affiliates (portfolio companies) and help maintain a high level of security across the group.

Key responsibilities:

• Ensure compliance with applicable laws, regulations and standards
• Develop, enforce and update security policies, standards and procedures
• Monitor and assess adherence to security guidelines across the group
• Conduct risk assessments, identify vulnerabilities and drive mitigation plans
• Track risk exposure and the effectiveness of mitigation actions, and report to management
• Maintain the information asset inventory and own the cybersecurity control catalog
• Lead internal security audits and respond to external audit requests
• Audit third parties (third-party risk and vendor management) and maintain the inventory of approved suppliers and tools
• Design and run security awareness initiatives, including phishing simulations, tailored to roles and departments
• Work with HR on the security aspects of the employee lifecycle (background checks, transfers, disciplinary actions, departures)
• Ensure the group's affiliates remain compliant with group cybersecurity policies and standards, with travel to their sites

Required profile:

• Minimum 5 years of experience in cybersecurity, with a focus on hands‑on auditing, governance and risk management
• Ideal background in cyber audit or consulting (Big4), followed by a CISO or IT Risk team in a regulated environment (bank or large group)
• Solid understanding of regulatory requirements and industry standards (NIS2)
• Familiarity with CIS Controls, NIST SP 800-53, NIST CSF and ISO 27001
• Knowledge of modern security architecture best practices and incident response
• A plus: CRISC or CISA certification
• A plus: cloud security and group-level security requirements
• A plus: knowledge of data protection and awareness of the topic
• A plus: ability to coordinate or lead a small team