Cybersecurity Governance, Risk & Compliance (GRC) Specialist

Blackfluo.ai; Paris; Sur place; EUR 70 000 - 90 000; Plein temps

Résumé du poste

A cybersecurity solutions company based in France is seeking a Cybersecurity Governance, Risk & Compliance (GRC) Specialist. In this role, you will implement leading cybersecurity frameworks, manage compliance with regulatory standards, and develop comprehensive governance programs. The ideal candidate will have over 5 years of experience and expertise in risk management methodologies. Strong proficiency in regulatory requirements is essential.

Qualifications

• 5+ years experience in cybersecurity governance, risk management, or compliance roles.
• Strong understanding of regulatory requirements (SOX, PCI-DSS, HIPAA, GDPR).
• Experience with vendor risk management and third-party security assessments.

Responsabilités

• Implement and maintain NIST Cybersecurity Framework across functions.
• Manage regulatory compliance programs including SOX and GDPR.
• Develop comprehensive cybersecurity policies and procedures.

Connaissances

Expert knowledge of NIST Cybersecurity Framework

Experience with GRC platforms

Knowledge of regulatory requirements

Proficiency in risk assessment methodologies

Formation

Bachelor's degree in Cybersecurity

Professional certifications (CISSP, CISA, etc.)

Outils

ServiceNow GRC

RSA Archer

Description du poste

Cybersecurity Governance, Risk & Compliance (GRC) Specialist

Job Openings Cybersecurity Governance, Risk & Compliance (GRC) Specialist

About the job Cybersecurity Governance, Risk & Compliance (GRC) Specialist

Cybersecurity Governance, Risk & Compliance (GRC) Specialist

Position Overview

We are seeking a Cybersecurity GRC Specialist to develop, implement, and manage comprehensive governance, risk, and compliance programs aligned with leading cybersecurity frameworks including NIST Cybersecurity Framework, ISO 27001/27002, MITRE ATT&CK, and CIS Controls to ensure organizational security posture and regulatory compliance.

Key Responsibilities

Framework Implementation & Management

• Implement and maintain NIST Cybersecurity Framework across organizational functions (Identify, Protect, Detect, Respond, Recover)

Develop ISO 27001/27002 Information Security Management System (ISMS) and manage certification processes

Map organizational security controls to CIS Controls and ensure implementation across all critical security functions

Integrate MITRE ATT&CK framework for threat modeling, risk assessment, and security control validation

Establish governance structures, policies, and procedures aligned with multiple cybersecurity standards

Conduct comprehensive cybersecurity risk assessments and business impact analyses

Develop risk treatment plans including risk acceptance, mitigation, transfer, and avoidance strategies

Maintain enterprise risk registers and ensure regular risk review and update processes

Perform gap analyses against security frameworks and develop remediation roadmaps

Create risk-based metrics and KPIs for executive reporting and board communications

Compliance & Audit Management

Manage regulatory compliance programs including SOX, PCI-DSS, HIPAA, GDPR, and industry-specific requirements

Coordinate internal and external security audits and manage audit finding remediation

Develop compliance monitoring programs and automated compliance reporting capabilities

Maintain evidence collection and documentation for compliance demonstrations

Support vendor risk assessments and third-party security evaluations

Policy & Governance Development

Develop comprehensive cybersecurity policies, standards, and procedures aligned with business objectives

Establish security governance committees and risk management oversight structures

Create security awareness training programs and ensure organization-wide policy compliance

Manage policy lifecycle including review, approval, communication, and periodic updates

Coordinate cross-functional collaboration for security program implementation

Required Qualifications

Technical Skills

5+ years experience in cybersecurity governance, risk management, or compliance roles

Expert knowledge of NIST Cybersecurity Framework, ISO 27001/27002, CIS Controls, and MITRE ATT&CK

Strong understanding of regulatory requirements (SOX, PCI-DSS, HIPAA, GDPR) and compliance methodologies

Experience with GRC platforms (ServiceNow GRC, RSA Archer, MetricStream) and risk management tools

Knowledge of security control frameworks and security architecture principles

Proficiency in risk assessment methodologies and quantitative risk analysis techniques

Governance Skills

Proven experience developing and implementing enterprise security governance programs

Strong understanding of business continuity, disaster recovery, and crisis management

Experience with vendor risk management and third-party security assessments

Knowledge of board reporting and executive communication for cybersecurity topics

Preferred Qualifications

Bachelor's degree in Cybersecurity, Risk Management, Business Administration, or related field

Professional certifications (CISSP, CISA, CRISC, CISM, ISO 27001 Lead Auditor)

Experience with cloud compliance frameworks (SOC 2, FedRAMP, CSA CCM)

Background in internal audit or external consulting for cybersecurity assessments

Knowledge of emerging regulations and privacy frameworks