Cybersecurity GRC Analyst

Job Description

We're looking for a detail-oriented, pragmatic, and business-focused Cybersecurity GRC Analyst to join our Group IT Headquarters team in the Paris region (Levallois-Perret). Reporting directly to the Group GRC Manager, you will help secure Devoteam’s global operations across 25 countries and over 50 business entities. In this role, you will bridge the gap between regulatory requirements and operational IT practices, ensuring security compliance, risk mitigation, and security-by-design across global projects and third-party SaaS applications.

• Support the implementation, maintenance, and continuous improvement of the Group Information Security Management System (ISMS) in alignment with ISO/IEC 27001, NIS2, and DORA frameworks.

• Conduct comprehensive cybersecurity risk assessments and gap analyses on internal systems, applications, and architecture projects.

• Drive Third-Party Risk Management (TPRM) by evaluating vendors, SaaS applications, and external partners using tools such as BitSight, OneTrust, or ServiceNow GRC.

• Champion Security by Design by reviewing technical data flows, IAM/MFA requirements, and security controls during project onboarding before go-live.

• Draft, review, and maintain Group security policies, procedures, and baseline documentation (PSSI) to ensure ongoing compliance.

• Standardize compliance evidence collection, monitor remediation action plans, and track KPIs across all 25 country entities.

• Stay ahead of emerging European regulations, assisting in risk and impact assessments for the EU AI Act and GDPR compliance.

• Prepare clear, executive-level risk reports and dashboards for the Group GRC Manager and key stakeholders.

Qualifications

• 1–3+ years of professional experience in Information Security, Cybersecurity Governance, Risk, and Compliance (GRC), or Security Auditing.

• Solid understanding of core information security frameworks and European regulations, including ISO/IEC 27001, NIS2, DORA, NIST CSF, and GDPR.

• Practical experience conducting risk assessments, gap analyses, and evaluating third-party vendor risks (TPRM).

• Working knowledge of core technical security controls, including Identity & Access Management (IAM), Multi-Factor Authentication (MFA), encryption, and SaaS security baselines.

• Exposure to GRC and vendor risk tools (e.g., ServiceNow GRC, OneTrust, BitSight) is a plus.

• Strong communication skills with the ability to translate complex regulatory and security requirements into actionable advice for business and technical teams.

• Relevant certifications or educational background in Computer Science, Cybersecurity, IT Law, or GRC (e.g., ISO 27001 Lead Auditor/Implementer, CIPP/E, CIPM) are highly valued.

• Full fluency in English (mandatory); French language skills are a strong plus.

Additional Information

The Devoteam Group works for equal opportunities, promoting its employees based on merit and actively fights against all forms of discrimination. We are convinced that diversity contributes to the creativity, dynamism and excellence of our organization. All of our vacancies are open to people with disabilities.