S Paris, France ( Non précisé ) Freelance · Non précisé aujourd'hui ›

Zeroday Cyber Academy; Paris; Hybrid; EUR 70,000 - 110,000; Full time

Job summary

Scality recherche un responsable sécurité de l’information pour diriger le programme de conformité et coordonner les opérations de sécurité. Vous dirigerez les certifications ISO 27001 et ISO 42001 (IA), gérerez les follow-ups CVE avec l’ingénierie et répondrez aux audits clients.

Le rôle est majoritairement orienté GRC et sécurité des produits (environ 70 %) et sécurité opérationnelle (30 %). Vous travaillerez avec les équipes Engineering et Support pour garantir les versions de correctifs et

Qualifications

• Diplôme en cybersécurité, systèmes d’information ou expérience équivalente.
• 2 à 5 ans d’expérience en sécurité de l’information, GRC ou sécurité opérationnelle.
• Basé en France.

Responsibilities

• Coordonner les opérations de sécurité et les demandes IT & sécurité entrantes.
• Conduire la gestion des vulnérabilités et le suivi des CVE au travers des SBOM et des rapports d’audit.
• Maintenir les programmes ISO 27001 et ISO 42001 et préparer les audits internes et externes.
• Gérer les contrôles mensuels, trimestriels et annuels et assurer les preuves d’audit.
• Contribuer à la revue de sécurité des tiers et des applications et à la sécurité produit et IA.
• Assurer la continuité et la réponse aux incidents de sécurité et à la gestion du changement.

Skills

Vulnerability management

GRC

Cloud/SaaS security

Security incident management

ISMS/ISO 27001

AI governance

Education

Degree in cybersecurity / information systems

Tools

Jira

Python

Bash

Job description

The team

The IT & Security team builds, runs and secures Scality's IT infrastructure and supports the whole Scality community (employees, contractors, consultants and freelancers). It also brings security expertise to the products (RING, ARTESCA, ADI) and to customers. You will join a team of 4 to 5 people with varied backgrounds (development, security, IT operations, helpdesk) and 2 to 30+ years of experience.

The mission

You will own Scality's information security compliance program and coordinate the team's security operations. You will lead the ISO 27001 and ISO 42001 (AI management system) certifications and manage vulnerability (CVE) follow-up with Engineering. You will answer customer security requests and audits, and help the products meet new regulations such as the EU Cyber Resilience Act (CRA).

The role is about 70% governance, risk and compliance (GRC) and product security, and 30% hands-on security operations.

You will own (Responsible)

• Security operations coordination: point of contact for incoming IT & Security requests, prioritize and dispatch them within the team.
• Vulnerability management: assess product exposure to CVEs by leveraging internal tools powered by Software Bills of Materials (SBOMs). Handle customer security requests (RD tickets) with Engineering and Support until a fix version or a customer answer is delivered. Track scan and pentest reports through remediation.
• ISO 27001 and ISO 42001 programs: maintain the framework, policies and procedures in the GRC tool. Run risk analysis and treatment plans, objectives and indicators, and the Statement of Applicability. Prepare internal and external audits and follow up on nonconformities and improvement opportunities.
• Control management: run the monthly, quarterly and annual controls (account and access reviews across HR system and SSO, application access, offboarding checks), automate them in Jira and keep audit evidence.
• ISMS processes: run security incident management and change management in Jira (workflows, fields, records), and the business continuity part of customer requests (ISO 22301-type questionnaires).
• Third-party and application security reviews: assess new SaaS tools, suppliers and internal applications or automations (no-code tools, Slack or AI integrations). Keep the supplier inventory and the service account inventory up to date.
• AI governance: maintain the AI systems inventory, review the AI features of tools before use, and follow regulatory changes (EU AI Act).
• Personal data: maintain the personal data inventory and processing records (GDPR, CNIL guidance) together with the data protection contact.
• Customer trust: answer security questionnaires and RFPs, and prepare evidence packages for customer audits (banking, telecom and public-sector customers).
• Security awareness: plan and run awareness and phishing campaigns, and track participation and click rates for managers.

You will contribute to (Contributor)

• Product security and certifications: prepare the EU Cyber Resilience Act (CRA) technical files per product (compliance matrix, risk assessment, SBOM, vulnerability handling, RACI). Contribute to CISA Secure by Design commitments and UK Cyber Essentials. Bring security input to the product roadmap, the development teams and the product documentation.
• Data leak prevention: define and tune DLP indicators and alerts (Google Workspace, Salesforce event monitoring) and investigate alerts.
• Infrastructure security: IaaS/PaaS security, monitoring and SIEM alerting, reporting of security incidents, business continuity and disaster recovery.
• Automation and tooling: scripts (Python, Bash) and Jira automations that reduce manual work.
• IT operations: account, application and permission management, level 1 and 2 network and security incidents.
• Mentoring: onboard and supervise interns or work-study students on security topics.

You will be informed of

Laptop fleet and IT room hardware, SSO integration and SaaS administration, level 3 network management, CI security, and relations with external IT providers (handled by other team members).

Desired profile

• Degree in cybersecurity, information systems or equivalent experience
• 2 to 5 years of experience in information security, GRC or security operations
• Based in France

Technical skills

• Practical experience with ISO 27001 (2022): risk analysis, Statement of Applicability, controls, internal or certification audits
• Knowledge of risk methodologies (ISO 27005, EBIOS RM or similar)
• Understanding of vulnerability management: CVE, CVSS, SBOM, reading scan and pentest reports
• Basic knowledge of identity and access management (SSO, SAML/OIDC, MFA, access reviews)
• Ability to assess the security of a SaaS tool or an application: data flows, permissions, data retention, use of data for AI training
• Jira (workflows, automation) and spreadsheets for control tracking
• Python or Bash scripting for automation
• Clear writing for policies, procedures and answers to customers

Bonus skills

ISO 42001, EU AI Act or AI risk management (e.g. ISO 23894); EU Cyber Resilience Act.

(La fin de l'annonce, après les bonus, n'a pas été transmise par la source.)