Nearshore Sector | GRC Analyst

Devoteam; Lisboa; On-site; EUR 55,000 - 90,000; Full time

Job summary

Devoteam is seeking a detail-oriented Cybersecurity GRC Analyst for the Group IT Headquarters in the Paris region (Levallois-Perret). You will bridge regulatory requirements and IT practices to ensure security compliance across 25 countries and 50+ entities.

You will support ISO 27001, NIS2, and DORA alignment, conduct risk assessments, manage third‑party risks, and help drive security by design across global projects and SaaS apps. English fluency is mandatory; French is a strong plus.

Qualifications

• 1–3+ years in Information Security, GRC or Security Auditing.
• Strong knowledge of ISO/IEC 27001, NIS2, DORA, GDPR.
• Experience with risk assessments and third‑party risk management.
• Familiarity with IAM/MFA, encryption, and SaaS security baselines.
• Fluency in English; French language skills are a plus.

Responsibilities

• Support the implementation, maintenance, and continuous improvement of the Group ISMS (ISO/IEC 27001) across the organization.
• Conduct risk assessments and gap analyses on systems and projects.
• Drive Third-Party Risk Management (TPRM) using tools like ServiceNow GRC, OneTrust, or BitSight.
• Champion Security by Design by reviewing IAM/MFA, data flows, and security controls during onboarding.
• Draft and maintain security policies, procedures, and baseline documentation.

Skills

GRC & InfoSec

Regulatory compliance

Risk assessment

Communication skills

Education

ISO 27001 Lead Auditor/Implementer

CIPP/E

CIPM

IT/Cybersecurity degree

Tools

ServiceNow GRC

OneTrust

BitSight

Job description

At Devoteam, we believe that technology with strong human values can actively drive change for the better. Discover how Tech for People unlocks the future, creating a positive impact on the people and the world around us. We are a global leading player in Digital Transformation for leading organisations across EMEA, with a revenue of €1B.

We believe in transforming technology to create value for our clients, partners and employees in a world where technology is developed for people. We are proud of the culture we have built together. We are proud of our people at the service of technology. We are proud of our diverse environment. Because we are #TechforPeople. Join our multidisciplinary team of Cloud experts, Designers, Business consultants, Security experts, Engineers, Developers and other extraordinary talents, spread across more than 20 EMEA countries. Become one of our +10.000 tech and business leaders on cloud, data and cyber security.

Let’s fuse creativity with technology together and build innovative solutions that actively change things for the better.

Job Description

We're looking for a detail-oriented, pragmatic, and business-focused Cybersecurity GRC Analyst to join our Group IT Headquarters team in the Paris region (Levallois-Perret). Reporting directly to the Group GRC Manager, you will help secure Devoteam’s global operations across 25 countries and over 50 business entities. In this role, you will bridge the gap between regulatory requirements and operational IT practices, ensuring security compliance, risk mitigation, and security-by-design across global projects and third-party SaaS applications.

• Support the implementation, maintenance, and continuous improvement of the Group Information Security Management System (ISMS) in alignment with ISO/IEC 27001, NIS2, and DORA frameworks.
• Conduct comprehensive cybersecurity risk assessments and gap analyses on internal systems, applications, and architecture projects.
• Drive Third-Party Risk Management (TPRM) by evaluating vendors, SaaS applications, and external partners using tools such as BitSight, OneTrust, or ServiceNow GRC.
• Champion Security by Design by reviewing technical data flows, IAM/MFA requirements, and security controls during project onboarding before go-live.
• Draft, review, and maintain Group security policies, procedures, and baseline documentation (PSSI) to ensure ongoing compliance.
• Standardize compliance evidence collection, monitor remediation action plans, and track KPIs across all 25 country entities.
• Stay ahead of emerging European regulations, assisting in risk and impact assessments for the EU AI Act and GDPR compliance.
• Prepare clear, executive-level risk reports and dashboards for the Group GRC Manager and key stakeholders.

Qualifications

• 1–3+ years of professional experience in Information Security, Cybersecurity Governance, Risk, and Compliance (GRC), or Security Auditing.
• Solid understanding of core information security frameworks and European regulations, including ISO/IEC 27001, NIS2, DORA, NIST CSF, and GDPR.
• Practical experience conducting risk assessments, gap analyses, and evaluating third-party vendor risks (TPRM).
• Working knowledge of core technical security controls, including Identity & Access Management (IAM), Multi-Factor Authentication (MFA), encryption, and SaaS security baselines.
• Exposure to GRC and vendor risk tools (e.g., ServiceNow GRC, OneTrust, BitSight) is a plus.
• Strong communication skills with the ability to translate complex regulatory and security requirements into actionable advice for business and technical teams.
• Relevant certifications or educational background in Computer Science, Cybersecurity, IT Law, or GRC (e.g., ISO 27001 Lead Auditor/Implementer, CIPP/E, CIPM) are highly valued.
• Full fluency in English (mandatory); French language skills are a strong plus.

Additional Information

The Devoteam Group works for equal opportunities, promoting its employees based on merit and actively fights against all forms of discrimination. We are convinced that diversity contributes to the creativity, dynamism and excellence of our organization. All of our vacancies are open to people with disabilities.