Nearshore Sector | GRC Analyst

Devoteam Portugal

7d • Onsite

About The Position

Devoteam is seeking a detail-oriented, pragmatic, and business-focused Cybersecurity GRC Analyst to join its Group IT Headquarters team in the Paris region (Levallois-Perret). Reporting to the Group GRC Manager, the analyst will help secure Devoteam’s global operations across 25 countries and more than 50 business entities. The role connects regulatory requirements with operational IT practices, supporting security compliance, risk mitigation, and security-by-design across global projects and third-party SaaS applications.

The analyst will support the Group Information Security Management System (ISMS), conduct cybersecurity risk assessments and gap analyses, and drive third-party risk management. The role also involves reviewing security controls during project onboarding, maintaining Group security documentation, tracking compliance and remediation across country entities, assessing emerging European regulatory requirements, and preparing executive-level risk reporting.

Requirements

• 1–3+ years of professional experience in Information Security, Cybersecurity Governance, Risk, and Compliance (GRC), or Security Auditing.
• Solid understanding of information security frameworks and European regulations, including ISO/IEC 27001, NIS2, DORA, NIST CSF, and GDPR.
• Practical experience conducting risk assessments, gap analyses, and third-party vendor risk evaluations (TPRM).
• Working knowledge of security controls including Identity & Access Management (IAM), Multi-Factor Authentication (MFA), encryption, and SaaS security baselines.
• Strong communication skills and the ability to translate complex regulatory and security requirements into actionable advice for business and technical teams.
• Full fluency in English is mandatory.

Nice To Haves

• Exposure to GRC and vendor risk tools such as ServiceNow GRC, OneTrust, or BitSight.
• Relevant certifications or educational background in Computer Science, Cybersecurity, IT Law, or GRC; examples include ISO 27001 Lead Auditor/Implementer, CIPP/E, and CIPM.
• French language skills.

Responsibilities

• Support implementation, maintenance, and continuous improvement of the Group Information Security Management System (ISMS) in alignment with ISO/IEC 27001, NIS2, and DORA.
• Conduct cybersecurity risk assessments and gap analyses on internal systems, applications, and architecture projects.
• Evaluate vendors, SaaS applications, and external partners as part of Third-Party Risk Management (TPRM), using tools such as BitSight, OneTrust, or ServiceNow GRC.
• Review technical data flows, IAM/MFA requirements, and security controls during project onboarding before go-live to promote Security by Design.
• Draft, review, and maintain Group security policies, procedures, and baseline documentation (PSSI).
• Standardize compliance evidence collection, monitor remediation action plans, and track KPIs across the 25 country entities.
• Assist with risk and impact assessments concerning the EU AI Act and GDPR compliance.
• Prepare executive-level risk reports and dashboards for the Group GRC Manager and key stakeholders.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level
• Education Level: No Education Listed