Cybersecurity GRC Analyst

About the role

Devoteam is looking for a detail-oriented, pragmatic and business-focused Cybersecurity GRC Analyst to join its Group IT Headquarters team in the Paris region (Levallois-Perret). Reporting directly to the Group GRC Manager, the analyst helps secure Devoteam's global operations across 25 countries and over 50 business entities, bridging regulatory requirements and operational IT practices. The role covers security compliance, risk mitigation and security-by-design across global projects and third-party SaaS applications.

Key responsibilities

• Support the implementation, maintenance and continuous improvement of the Group Information Security Management System (ISMS) aligned with ISO/IEC 27001, NIS2 and DORA.
• Conduct cybersecurity risk assessments and gap analyses on internal systems, applications and architecture projects.
• Drive Third-Party Risk Management (TPRM) by evaluating vendors, SaaS applications and external partners using tools such as BitSight, OneTrust or ServiceNow GRC.
• Champion Security by Design by reviewing technical data flows, IAM/MFA requirements and security controls during project onboarding before go-live.
• Draft, review and maintain Group security policies, procedures and baseline documentation (PSSI).
• Standardize compliance evidence collection, monitor remediation action plans and track KPIs across all 25 country entities.
• Assist in risk and impact assessments for the EU AI Act and GDPR compliance.
• Prepare executive-level risk reports and dashboards for the Group GRC Manager and key stakeholders.

Required profile

• 1-3+ years of experience in Information Security, Cybersecurity GRC, or Security Auditing.
• Solid understanding of core information security frameworks and European regulations, including ISO/IEC 27001, NIS2, DORA, NIST CSF and GDPR.
• Practical experience with risk assessments, gap analyses and third-party vendor risk evaluation.
• Strong communication skills, able to turn complex regulatory and security requirements into actionable advice for business and technical teams.
• Full fluency in English (mandatory); French is a strong plus.
• Certifications or education in Computer Science, Cybersecurity, IT Law or GRC (e.g. ISO 27001 Lead Auditor/Implementer, CIPP/E, CIPM) are highly valued.

Required skills

• Knowledge of technical security controls such as IAM, MFA, encryption and SaaS security baselines.
• Exposure to GRC and vendor risk tools (ServiceNow GRC, OneTrust, BitSight) is a plus.