Cybersecurity Consultant Auditor - CLA

Keoni; Paris; Hybrid; EUR 70,000 - 100,000; Full time

Job summary

Demartino Law seeks a cybersecurity consultant auditor to evaluate the organization’s information security maturity against ANSSI, NIS2 and ISO 27001, identify gaps and risks, and map a pragmatic remediation roadmap. You will interview stakeholders, assess governance, IAM, backup, incident management, vulnerability handling, and produce actionable recommendations with an executive summary.

Responsibilities include mapping priority risks, delivering a prioritized plan, and presenting findings to

Qualifications

• Proficiency in ISO 27001, ISO 27002, NIS2, ANSSI and security best practices.
• Strong risk analysis methods, especially EBIOS RM or equivalent.
• Ability to audit IAM, MFA, privilege management, access controls and reviews.
• Knowledge of backup, DRP/BCP, crisis management and resilience mechanisms.

Responsibilities

• Prepare mission scope, collect documents, interview stakeholders and define audit scope.
• Interview business, IT, security, operations and management personnel.
• Assess maturity, map risks and vulnerabilities, and draft remediation actions.
• Deliver final report with prioritised actions and an executive summary.

Skills

ISO 27001

NIS2

ANSSI recommendations

Risk analysis

EBIOS RM

IAM audit

MFA

Privilege management

Access reviews

DRP/BCP

Vulnerability management

Patch management

Cloud/hybrid

Evidence analysis

Technical writing

Stakeholder management

Education

ISO 27001 Lead Auditor

ISO 27001 Lead Implementer

EBIOS RM

CISSP

CISM

CISA

CRISC

Job description

# Cybersecurity Consultant Auditor - CLA* Home* Cybersecurity Consultant Auditor - CLA* July 8, 2026* 0 Comments* By Roberte Okoya1. Mission Context: In a context of increasingly stringent regulatory, normative, and operational cybersecurity requirements, the organization wishes to assess the maturity of its information system, identify priority risks, measure compliance gaps, and define a pragmatic and prioritized remediation roadmap. 2. Mission Objectives : • Evaluate the cybersecurity maturity of the information system against best practices and reference frameworks, including ANSSI, NIS2, and ISO 27001. • Identify major cyber risks, critical vulnerabilities, and compliance gaps. • Analyze governance, protection, detection, response, and resilience mechanisms. • Propose a prioritized, realistic remediation plan tailored to business, technical, and regulatory challenges. • Provide a clear summary for technical, business, and decision-making stakeholders. 3. Scope of Intervention : • Information security governance, security policy, organization, and associated roles. • Identity and access management, authentication, authorizations, and rights reviews. • Backup, recovery, business continuity, and disaster recovery: Disaster Recovery Plan (DRP)/Business Continuity Plan (BCP). • Security incident management, escalation procedures, logging, and monitoring. • Vulnerability management, update processes, hardening, and remediation. • Compliance with applicable standards and requirements: ANSSI, NIS2, ISO 27001, and cybersecurity best practices. 4. Main Activities • Prepare and define the mission: document collection, interviews, and definition of the audit scope and schedule. • Conduct interviews with business, IT, security, operations, and management stakeholders. • Analyze existing processes, procedures, policies, documentation, and technical systems. • Assess the cybersecurity maturity level and identify gaps compared to reference requirements. • Map priority risks, vulnerabilities, and weaknesses. • Formulate operational, organizational, and technical recommendations. • Develop a prioritized action plan based on criticality level, implementation effort, and expected impact. • Present the audit results and facilitate understanding of the remediation measures. 5. Expected Skills • Proficiency in security standards and frameworks: ISO 27001, ISO 27002, NIS2, ANSSI recommendations, information systems security best practices. • Good knowledge of risk analysis methods, particularly EBIOS RM or equivalent. • Ability to audit IAM, MFA, privilege management, access control reviews, and access management systems. • Knowledge of backup, recovery, disaster recovery/business continuity planning, crisis management, and operational resilience mechanisms. • Understanding of IT architectures, infrastructure, networks, systems, workstations, and cloud or hybrid environments. • Proficiency in vulnerability management, patch management, hardening, monitoring, and detection processes. • Ability to analyze audit evidence, document findings, and write clear and actionable recommendations. • Excellent writing skills, ability to synthesize information, methodological rigor, and the ability to explain complex cybersecurity topics in simple terms. 6. Required Profile • Experienced cybersecurity consultant, information systems security auditor, GRC consultant, deputy CISO, or equivalent profile. • Significant experience in conducting cybersecurity maturity audits, risk analyses, or compliance engagements. • Good understanding of the business, regulatory, and technical issues related to information systems security. • Ability to work with diverse stakeholders: management, CIO, CISO, infrastructure, production, business, and compliance teams. • Autonomy, organizational skills, consultative approach, confidentiality, and ability to prioritize risks. • Preferred certifications: ISO 27001 Lead Auditor or Lead Implementer, EBIOS RM, CISSP, CISM, CISA, CRISC, or equivalent. • Desired experience in regulated, critical, or high-compliance environments. 7. Expected Deliverables • Mission scoping document and intervention plan. • Cybersecurity maturity assessment. • Mapping of identified risks, vulnerabilities, and weaknesses. • Analysis of compliance gaps compared to selected standards. • Prioritized short-, medium-, and long-term remediation plan. • Executive summary for management. • Detailed audit report including findings, criticality levels, impacts, recommendations, and action priorities. 8. Intervention Methods • Intervention in the form of interviews, workshops, document reviews, and evidence analysis. • Close collaboration with IT, security, business, compliance, and management teams. • Interim reports may be provided to validate findings and priorities. • Final report including a summary presentation of major risks and the remediation plan. • Strict adherence to the confidentiality of information collected during the mission. 9. Success Criteria • A clear and shared understanding of the organization's cybersecurity maturity level. • Identification of priority risks and major vulnerabilities. • Concrete, prioritized recommendations tailored to operational constraints. • An action plan that can be implemented by the relevant teams. • A presentation that is understandable to both technical and non-technical stakeholders.Please send your CV, cover letter, and copies of your diplomas to [e-mail]