Product Development Cyber Risk Specialist

Marlink; France; Hybride; EUR 70 000 - 110 000; Plein temps

Résumé du poste

Marlink in France seeks a senior cybersecurity professional to guide and support project managers in embedding secure-by-design practices across the lifecycle of digital products and services.

You will translate regulatory requirements (CRA/NIS2) into actionable controls, support ISO27001 ISMS, and coordinate threat modeling, vulnerability management, and audit-ready documentation with cross-functional teams.

Qualifications

• 5–10 years of cybersecurity experience, ideally in regulated or product-focused environments.
• Strong knowledge of ISO27001/27002, ISO27005, and OWASP standards.
• Experience with risk assessment and threat modeling methods (EBIOS RM, STRIDE, TARA).
• Hands-on with vulnerability management and security testing (SAST/SCA/DAST).
• DevSecOps in CI/CD environments; secure-by-design mindset.
• Ability to secure web, cloud, networked, and embedded/IoT architectures.
• Additional experience in pentesting or security architecture is a plus.
• Fluent English with good writing/presentation skills.

Responsabilités

• Embed cybersecurity requirements from earliest project stages and ensure consistent application.
• Perform threat modeling and cyber risk assessments (EBIOS RM).
• Translate CRA/NIS2 into actionable security controls and deliverables.
• Support ISO27001 ISMS implementation and AnnexA alignment.
• Define and monitor vulnerability management in CI/CD pipelines (SAST, SCA, DAST).
• Review architectures to ensure effective controls and risk mitigation.
• Coordinate remediation actions with developers and stakeholders.
• Produce audit-ready documentation and compliance evidence.

Connaissances

5-10 years

ISO27001/27002

OWASP Top10

EBIOS RM

STRIDE

TARA

SAST

SCA

DAST

DevSecOps

Web/Cloud/Embedded

Penetration Testing

Outils

SAST Tools

SCA Tools

DAST Tools

CI/CD Security Tools

Description du poste

Your Mission

Guide and support project managers in integrating cybersecurity throughout the lifecycle of digital products and services.

The mission focuses on ensuring compliance with key regulations such as CRA and NIS2, alignment with international standards including ISO27001, and application of recognized best practices like OWASP.

The role also includes managing cyber risks and vulnerabilities to ensure secure‑by‑design and secure‑by‑default products and services.

Main Tasks

Embed cybersecurity requirements from the earliest project stages and ensure their consistent application throughout the project lifecycle.

Perform and review threat modeling and cyber risk assessments using methods such as EBIOS RM.

Translate regulatory requirements (CRA, NIS2) into actionable security controls and project deliverables.

Support ISO27001 ISMS implementation and align project activities with AnnexA controls.

Define, implement, and monitor vulnerability management frameworks, including integration of SAST, SCA, and DAST tools in CI/CD pipelines

Review system, application, cloud, and embedded architectures to ensure effective security controls and risk mitigation.

Coordinate with developers, architects, and stakeholders to track remediation actions and ensure closure of critical vulnerabilities.

Produce audit‑ready documentation, security assessments, and compliance evidence.

Qualifications & Professional skills

• 5 to 10 years of experience in cybersecurity, preferably in product‑oriented or regulated environments.
• Strong knowledge of cybersecurity frameworks and standards: ISO27001/27002, ISO27005, OWASP (Top10, ASVS, SAMM).
• Solid experience in risk assessment and threat modeling methodologies (EBIOSRM, STRIDE, TARA).
• Practical understanding of vulnerability management processes and security testing tools (SAST, SCA, DAST).
• Expertise in integrating DevSecOps practices within CI/CD environments.
• Ability to assess and secure diverse architectures: web, cloud, networked systems, and embedded/IoT.
• Additional experience in penetration testing, security auditing, or security architecture is an asset.
• Fluent English with good writing and presentation skills

Attitude & Interpersonal skills

• Strong communication skills, with the ability to engage and advise diverse stakeholders.
• Analytical mindset and structured approach to problem solving and risk evaluation.
• Proactive attitude with a focus on continuous improvement of security practices.
• Ability to collaborate effectively across project management, R&D, IT, and security teams.
• Strong technical writing skills to produce clear, actionable, and audit‑ready documentation.
• Comfortable challenging designs and decisions constructively to enhance security posture.