Cybersecurity Governance, Risk & Compliance (GRC) Specialist

BlackFluoAI; France; Sur place; EUR 60 000 - 90 000; Plein temps

Résumé du poste

A leading technology company in France is seeking a Cybersecurity GRC Specialist to manage governance, risk, and compliance programs. The ideal candidate has over 5 years of experience, expert knowledge of cybersecurity frameworks like NIST and ISO, and a strong understanding of regulatory compliance. Join us to enhance organizational security posture and ensure regulatory compliance.

Qualifications

• 5+ years experience in cybersecurity governance, risk management, or compliance roles.
• Strong understanding of regulatory requirements and compliance methodologies.
• Proficient in risk assessment methodologies and quantitative risk analysis techniques.

Responsabilités

• Implement and maintain NIST Cybersecurity Framework.
• Conduct comprehensive cybersecurity risk assessments.
• Manage regulatory compliance programs including SOX, PCI-DSS, HIPAA, GDPR.
• Develop comprehensive cybersecurity policies, standards, and procedures.

Connaissances

NIST Cybersecurity Framework

ISO 27001/27002

CIS Controls

MITRE ATT&CK

Regulatory requirements (SOX, PCI-DSS, HIPAA, GDPR)

GRC platforms (ServiceNow GRC, RSA Archer, MetricStream)

Risk assessment methodologies

Formation

Bachelor's degree in Cybersecurity, Risk Management, Business Administration, or related field

Description du poste

About the job Cybersecurity Governance, Risk & Compliance (GRC) Specialist

Position Overview

We are seeking a Cybersecurity GRC Specialist to develop, implement, and manage comprehensive governance, risk, and compliance programs aligned with leading cybersecurity frameworks including NIST Cybersecurity Framework, ISO 27001/27002, MITRE ATT&CK, and CIS Controls to ensure organizational security posture and regulatory compliance.

Key Responsibilities

Framework Implementation & Management

• Implement and maintain NIST Cybersecurity Framework across organizational functions (Identify, Protect, Detect, Respond, Recover)
• Develop ISO 27001/27002 Information Security Management System (ISMS) and manage certification processes
• Map organizational security controls to CIS Controls and ensure implementation across all critical security functions
• Integrate MITRE ATT&CK framework for threat modeling, risk assessment, and security control validation
• Establish governance structures, policies, and procedures aligned with multiple cybersecurity standards

Risk Assessment & Management

• Conduct comprehensive cybersecurity risk assessments and business impact analyses
• Develop risk treatment plans including risk acceptance, mitigation, transfer, and avoidance strategies
• Maintain enterprise risk registers and ensure regular risk review and update processes
• Perform gap analyses against security frameworks and develop remediation roadmaps
• Create risk-based metrics and KPIs for executive reporting and board communications

Compliance & Audit Management

• Manage regulatory compliance programs including SOX, PCI-DSS, HIPAA, GDPR, and industry-specific requirements
• Coordinate internal and external security audits and manage audit finding remediation
• Develop compliance monitoring programs and automated compliance reporting capabilities
• Maintain evidence collection and documentation for compliance demonstrations
• Support vendor risk assessments and third-party security evaluations

Policy & Governance Development

• Develop comprehensive cybersecurity policies, standards, and procedures aligned with business objectives
• Establish security governance committees and risk management oversight structures
• Create security awareness training programs and ensure organization-wide policy compliance
• Manage policy lifecycle including review, approval, communication, and periodic updates
• Coordinate cross-functional collaboration for security program implementation

Required Qualifications

Technical Skills

• 5+ years experience in cybersecurity governance, risk management, or compliance roles
• Expert knowledge of NIST Cybersecurity Framework, ISO 27001/27002, CIS Controls, and MITRE ATT&CK
• Strong understanding of regulatory requirements (SOX, PCI-DSS, HIPAA, GDPR) and compliance methodologies
• Experience with GRC platforms (ServiceNow GRC, RSA Archer, MetricStream) and risk management tools
• Knowledge of security control frameworks and security architecture principles
• Proficiency in risk assessment methodologies and quantitative risk analysis techniques

Governance Skills

• Proven experience developing and implementing enterprise security governance programs
• Strong understanding of business continuity, disaster recovery, and crisis management
• Experience with vendor risk management and third-party security assessments
• Knowledge of board reporting and executive communication for cybersecurity topics

Preferred Qualifications

• Bachelor's degree in Cybersecurity, Risk Management, Business Administration, or related field
• Professional certifications (CISSP, CISA, CRISC, CISM, ISO 27001 Lead Auditor)
• Experience with cloud compliance frameworks (SOC 2, FedRAMP, CSA CCM)
• Background in internal audit or external consulting for cybersecurity assessments
• Knowledge of emerging regulations and privacy frameworks