CDI - Cyber Risk Assessment Service Manager F/H

STMicroelectronics; Grenoble; On-site; EUR 70,000 - 110,000; Full time

Job summary

STMicroelectronics is seeking a Cybersecurity Risk Assessment Expert to join our Central Information Security team within the Corporate Security Organization (CSO). You will lead 360° risk assessments of IT solutions, work with external consultants, and help address gaps to ensure risks are understood and mitigated.

The role requires 5+ years in cybersecurity, strong knowledge of ISO 2700x/NIST, and fluent English.

Qualifications

• 5+ years of experience in cybersecurity.
• Sound knowledge of cybersecurity risk assessments / management.
• Sound knowledge of security standards (such as ISO 2700x, NIST) and regulations.
• Master in cybersecurity, IT or equivalent experience.
• Fluency in English within a professional context (written and spoken).
• Cybersecurity certifications (CISSP, CISM, CRISC, SANS…) is a plus.

Responsibilities

• Manage the risk assessment part of the service “Security Assurance as a Service”. Ensure the deliverables are delivered on time and of the expected quality.
• Perform business impact assessments to determine the security/availability rating of IT solutions.
• Participate in the genesis and maintenance of the yearly security assessments plan.
• Conduct thorough risk assessments of IT solutions, covering all aspects, such as: identification of specific cybersecurity requirements, accounts management and authentication, access rights management and data protection, logging and audit features, adherence to security framework.
• Keep the central risk database up to date with the results of such risk assessment, ensuring that risks are documented and understood.
• Work closely with stakeholders to close the security gaps detected.
• Using the knowledge acquired from the above activities: participate in updates to risk registers and propose improvements in methodology and tooling and framework.

Skills

Cybersecurity experience

Risk assessment

Security standards knowledge

Master in cybersecurity / IT

English proficiency

Certifications in cybersecurity

Education

Master's degree in cybersecurity / IT

Job description

At STMicroelectronics, we believe in the power of technology to drive innovation and make a positive impact on people, businesses, and society. As a global semiconductor company, our advanced technologies and chips form the hidden foundation of the world we live in today.

When you join ST, you will be part of a global business with more than 115 nationalities, present in 40 countries, and comprising over 50,000 diverse and dedicated creators and makers of technology around the world.

Developing technologies takes more than talent: it takes amazing people who understand collaboration and respect. People with passion and the desire to disrupt the status quo, drive innovation, and unlock their own potential.

Embark on a journey with us, where you can innovate for a future that we want to make smarter and greener, in a responsible and sustainable way. Our technology starts with you.

English version:

Do you thrive on building secure and resilient information systems? Do you have a strong interest in cybersecurity and want to develop your career in this domain?

ST is seeking a talented and motivated Cybersecurity Risk Assessment Expert to join our Central Information Security department within the newly created Corporate Security Organization (CSO). You will play a key role in safeguarding the digital and industrial solutions of the company.

With the support of a pool of external consultants, the candidate will perform 360 degrees security risk assessments of IT solutions, and support the teams concerned in addressing the gaps detected, ensuring that risks are understood and managed.

Main responsibilities:

• Manage the risk assessment part of the service “Security Assurance as a Service”. Ensure the deliverables are delivered on time and of the expected quality.
• Perform business impact assessments to determine the security/availability rating of IT solutions.
• Participate in the genesis and maintenance of the yearly security assessments plan.
• Conduct thorough risk assessments of IT solutions, covering all aspects, such as:
  • Identification of specific cybersecurity requirements.
  • Accounts management and authentication.
  • Access rights management and data protection.
  • Logging and audit features.
  • Adherence to the security framework (architecture, software development, contractual and regulatory aspects).
• Keep the central risk database up to date with the results of such risk assessment, ensuring that risks are documented and understood.
• Work closely with stakeholders to close the security gaps detected.
• Using the knowledge acquired from the above activities:
  • Participate in the update of the company cybersecurity risk register and cybersecurity company program.
  • Propose improvements in the security risk assessments methodology and tooling.
  • Propose improvements in the company information security framework and monitoring activities.

Skills:

• 5+ years’ experience in cybersecurity.
• Sound knowledge of cybersecurity risk assessments / management.
• Sound knowledge of security standards (such as ISO 2700x, NIST) and regulations.
• Master in cybersecurity, IT or equivalent experience.
• Fluency in English within a professional context (written and spoken).
• Cybersecurity certifications (CISSP, CISM, CRISC, SANS…) is a plus.

Soft Skills:

• Ability to manage a team of external consultants.
• Very good problem-solving, analytical, and communication skills.
• Ability to translate technical aspects into risks and to communicate on those risks.
• Strong integrity, rigor and proactivity are a must.
• Autonomous.

French version:

ST recherche un(e) Expert(e) en Évaluation des Risques Cybersécurité talentueux(se) et motivé(e) pour rejoindre son département central de Sécurité de l’Information au sein de la nouvelle Corporate Security Organization (CSO) (désormais indépendante du groupe DTIT).

Ce poste à dimension mondiale peut être basé sur n’importe quel site ST (Grenoble, Crolles, Rousset, Paris, Catane, Singapour ou Greater Noida sont privilégiés, mais les candidatures de toute localisation seront étudiées). Vous jouerez un rôle clé dans la protection des solutions numériques et industrielles de l’entreprise.

Avec le soutien d’un pool de consultants externes, le/la candidat(e) réalisera des évaluations de risques cybersécurité à 360° des solutions informatiques et accompagnera les équipes concernées dans la mise en œuvre des actions correctives nécessaires, afin de garantir que les risques soient bien compris et maîtrisés.

Principales responsabilités :

• Gérer le volet évaluation des risques du service « Security Assurance as a Service ». Veiller à ce que les livrables soient fournis dans les délais et avec le niveau de qualité attendu.
• Réaliser des analyses d’impact métier afin de déterminer le niveau de sécurité/disponibilité des solutions IT
• Participer à l’élaboration et au maintien du plan annuel d’évaluations de sécurité.
• Mener des évaluations approfondies des risques liés aux solutions IT, couvrant notamment :
  • L’identification des exigences spécifiques en cybersécurité.
  • La gestion des comptes et des mécanismes d’authentification.
  • La gestion des droits d’accès et la protection des données.
  • Les fonctionnalités de journalisation et d’audit.
  • La conformité au cadre de sécurité (architecture, développement logiciel, aspects contractuels et réglementaires).
• Maintenir à jour la base de données centrale des risques avec les résultats des évaluations réalisées, en veillant à ce que les risques soient correctement documentés et compris.
• Travailler en étroite collaboration avec les parties prenantes afin de corriger les écarts de sécurité identifiés.
• En s’appuyant sur les connaissances acquises lors des activités précédentes :
  • Participer à la mise à jour du registre des risques cybersécurité de l’entreprise ainsi que du programme cybersécurité de l’entreprise.
  • Proposer des améliorations de la méthodologie et des outils d’évaluation des risques de sécurité.
  • Proposer des améliorations du cadre de sécurité de l’information de l’entreprise et des activités de surveillance associées.

Compétences :

• Plus de 5 ans d’expérience en cybersécurité.
• Bonne maîtrise de l’évaluation et de la gestion des risques cybersécurité.
• Bonne connaissance des normes de sécurité (telles que ISO 2700x, NIST) et des réglementations associées.
• Master en cybersécurité, informatique ou expérience équivalente.
• Maîtrise l’anglais dans un contexte professionnel (oral et écrit).
• Les certifications en cybersécurité (CISSP, CISM, CRISC, SANS, etc.) constituent un atout.

Compétences comportementales :

• Capacité à gérer une équipe de consultants externes.
• Excellentes capacités d’analyse, de résolution de problèmes et de communication.
• Capacité à traduire des aspects techniques en risques et à communiquer efficacement sur ces risques.
• Une forte intégrité, de la rigueur et de la proactivité sont indispensables.
• Autonomie.

ST is proud to be one of the 17 companies certified as a 2025 Global Top Employer and the first and only semiconductor company to achieve this distinction. ST was recognized in this ranking thanks to its continuous improvement approach and stands out particularly in the areas of ethics & integrity, purpose & values, organization & change, business strategy, and performance.

At ST, we endeavor to foster a diverse and inclusive workplace, and we do not tolerate discrimination. We aim to recruit and retain a diverse workforce that reflects the societies around us. We strive for equity in career development, career opportunities, and equal remuneration. We encourage candidates who may not meet every single requirement to apply, as we appreciate diverse perspectives and provide opportunities for growth and learning. Diversity, equity, and inclusion (DEI) is woven into our company culture.

To discover more, visit st.com/careers.