About Devoteam
At Devoteam, we believe that technology with strong human values can actively drive change for the better. We are a global leading player in Digital Transformation for leading organisations across EMEA, with a revenue of €1B. Join our multidisciplinary team of Cloud experts, Designers, Business consultants, Security experts, Engineers, Developers and other extraordinary talents, spread across more than 20 EMEA countries — more than +10,000 tech and business leaders on cloud, data and cyber security.
Задачи
We're looking for a detail-oriented, pragmatic, and business-focused Cybersecurity GRC Analyst to join our Group IT Headquarters team in the Paris region (Levallois-Perret). Reporting directly to the Group GRC Manager, you will help secure Devoteam's global operations across 25 countries and over 50 business entities. In this role, you will bridge the gap between regulatory requirements and operational IT practices, ensuring security compliance, risk mitigation, and security-by-design across global projects and third-party SaaS applications.
•Support the implementation, maintenance, and continuous improvement of the Group Information Security Management System (ISMS) in alignment with ISO/IEC 27001, NIS2, and DORA frameworks.
•Conduct comprehensive cybersecurity risk assessments and gap analyses on internal systems, applications, and architecture projects.
•Drive Third-Party Risk Management (TPRM) by evaluating vendors, SaaS applications, and external partners using tools such as BitSight, OneTrust, or ServiceNow GRC.
•Champion Security by Design by reviewing technical data flows, IAM/MFA requirements, and security controls during project onboarding before go-live.
•Draft, review, and maintain Group security policies, procedures, and baseline documentation (PSSI) to ensure ongoing compliance.
•Standardize compliance evidence collection, monitor remediation action plans, and track KPIs across all 25 country entities.
•Stay ahead of emerging European regulations, assisting in risk and impact assessments for the EU AI Act and GDPR compliance.
•Prepare clear, executive-level risk reports and dashboards for the Group GRC Manager and key stakeholders.
Требования
•1–3+ years of professional experience in Information Security, Cybersecurity Governance, Risk, and Compliance (GRC), or Security Auditing.
•Solid understanding of core information security frameworks and European regulations, including ISO/IEC 27001, NIS2, DORA, NIST CSF, and GDPR.
•Practical experience conducting risk assessments, gap analyses, and evaluating third-party vendor risks (TPRM).
•Working knowledge of core technical security controls, including Identity & Access Management (IAM), Multi-Factor Authentication (MFA), encryption, and SaaS security baselines.
•Exposure to GRC and vendor risk tools (e.g., ServiceNow GRC, OneTrust, BitSight) is a plus.
•Strong communication skills with the ability to translate complex regulatory and security requirements into actionable advice for business and technical teams.
•Relevant certifications or educational background in Computer Science, Cybersecurity, IT Law, or GRC (e.g., ISO 27001 Lead Auditor/Implementer, CIPP/E, CIPM) are highly valued.
•Full fluency in English (mandatory); French language skills are a strong plus.
