Nearshore Sector | GRC Analyst

Devoteam; United States; Remote; USD 56,000 - 79,000; Full time

Job summary

Devoteam приглашает к участию в команде Group IT Headquarters в регионе Парижа (Levallois-Perret) сегменте GRC. Вы будете обеспечивать соответствие требованиям и проводить анализ рисков в 25 странах и более 50 бизнес-единицах, внедрять ISMS и обеспечивать безопасность проектов и сторонних SaaS.

Идеально — 1–3+ лет опыта в информационной безопасности и GRC, владение инструментами GRC (ServiceNow GRC, OneTrust, BitSight), свободный английский язык; французский — плюс.

Qualifications

• Необходимо знание основных фреймворков информационной безопасности и регуляций ЕС (ISO 27001, NIS2, DORA, NIST CSF, GDPR).
• Опыт проведения аудита рисков, анализа gaps и оценки рисков поставщиков (TPRM).
• Опыт работы с IAM/MFA, шифрованием и безопасными базами SaaS.
• Умение переводить требования регуляторов в практические техмеры для бизнеса и ИТ.

Responsibilities

• Обеспечение соответствия Group ISMS и безопасности по проектам across 25 юрисдикций.
• Проведение оценок рисков и аналитик по внутренним системам, приложениям и архитектурным проектам.
• Управление TPRM: оценка поставщиков и SaaS по инструментам как BitSight, OneTrust, ServiceNow GRC.
• Разработка и поддержка политик и документации по безопасности (PSSI).
• Отслеживание KPI, сбор доказательств комплаенса и создание exec-отчетов.

Skills

Английский язык (свободно)

Коммуникация

Робота в GRC

Education

ISO 27001 Lead Auditor/Implementer

CIPP/E / CIPM

Степень в CS/Cybersecurity/GRC

Tools

ServiceNow GRC

OneTrust

BitSight

Job description

Описание:

At Devoteam, we believe that technology with strong human values can actively drive change for the better. Discover how Tech for People unlocks the future, creating a positive impact on the people and the world around us. We are a global leading player in Digital Transformation for leading organisations across EMEA, with a revenue of €1B. We believe in transforming technology to create value for our clients, partners and employees in a world where technology is developed for people. We are proud of the culture we have built together. We are proud of our people at the service of technology. We are proud of our diverse environment. Because we are . Join our multidisciplinary team of Cloud experts, Designers, Business consultants, Security experts, Engineers, Developers and other extraordinary talents, spread across more than 20 EMEA countries. Become one of our +10.000 tech and business leaders on cloud, data and cyber security. Let’s fuse creativity with technology together and build innovative solutions that actively change things for the better.

Задачи:

We're looking for a detail-oriented, pragmatic, and business-focused Cybersecurity GRC Analyst to join our Group IT Headquarters team in the Paris region (Levallois-Perret). Reporting directly to the Group GRC Manager, you will help secure Devoteam’s global operations across 25 countries and over 50 business entities. In this role, you will bridge the gap between regulatory requirements and operational IT practices, ensuring security compliance, risk mitigation, and security-by-design across global projects and third-party SaaS applications. Support the implementation, maintenance, and continuous improvement of the Group Information Security Management System (ISMS) in alignment with ISO/IEC 27001, NIS2, and DORA frameworks. Conduct comprehensive cybersecurity risk assessments and gap analyses on internal systems, applications, and architecture projects. Drive Third-Party Risk Management (TPRM) by evaluating vendors, SaaS applications, and external partners using tools such as BitSight, OneTrust, or ServiceNow GRC. Champion Security by Design by reviewing technical data flows, IAM/MFA requirements, and security controls during project onboarding before go-live. Draft, review, and maintain Group security policies, procedures, and baseline documentation (PSSI) to ensure ongoing compliance. Standardize compliance evidence collection, monitor remediation action plans, and track KPIs across all 25 country entities. Stay ahead of emerging European regulations, assisting in risk and impact assessments for the EU AI Act and GDPR compliance. Prepare clear, executive-level risk reports and dashboards for the Group GRC Manager and key stakeholders.

Требования:

• 1–3+ years of professional experience in Information Security, Cybersecurity Governance, Risk, and Compliance (GRC), or Security Auditing. Solid understanding of core information security frameworks and European regulations, including ISO/IEC 27001, NIS2, DORA, NIST CSF, and GDPR. Practical experience conducting risk assessments, gap analyses, and evaluating third-party vendor risks (TPRM). Working knowledge of core technical security controls, including Identity & Access Management (IAM), Multi-Factor Authentication (MFA), encryption, and SaaS security baselines. Exposure to GRC and vendor risk tools (e.g., ServiceNow GRC, OneTrust, BitSight) is a plus. Strong communication skills with the ability to translate complex regulatory and security requirements into actionable advice for business and technical teams. Relevant certifications or educational background in Computer Science, Cybersecurity, IT Law, or GRC (e.g., ISO 27001 Lead Auditor/Implementer, CIPP/E, CIPM) are highly valued. Full fluency in English (mandatory); French language skills are a strong plus.

Additional Information

The Devoteam Group works for equal opportunities, promoting its employees based on merit and actively fights against all forms of discrimination. We are convinced that diversity contributes to the creativity, dynamism and excellence of our organization. All of our vacancies are open to people with disabilities.