CDI - Cyber Risk Assessment Service Manager F/H

About us

At STMicroelectronics, we believe in the power of technology to drive innovation and make a positive impact on people, businesses, and society. As a global semiconductor company, our advanced technologies and chips form the hidden foundation of the world we live in today.

When you join ST, you will be part of a global business with more than 115 nationalities, present in 40 countries, and comprising over 50,000 diverse and dedicated creators and makers of technology around the world.

Developing technologies takes more than talent: it takes amazing people who understand collaboration and respect. People with passion and the desire to disrupt the status quo, drive innovation, and unlock their own potential.

Embark on a journey with us, where you can innovate for a future that we want to make smarter and greener, in a responsible and sustainable way. Our technology starts with you.

---

English version:

Do you thrive on building secure and resilient information systems? Do you have a strong interest in cybersecurity and want to develop your career in this domain?

Main responsibilities:

• Manage the risk assessment part of the service “Security Assurance as a Service”. Ensure the deliverables are delivered on time and of the expected quality.
• Perform business impact assessments to determine the security/availability rating of IT solutions.
• Participate in the genesis and maintenance of the yearly security assessments plan.
• Conduct thorough risk assessments of IT solutions, covering all aspects, such as:
  • Identification of specific cybersecurity requirements.
  • Accounts management and authentication.
  • Access rights management and data protection.
  • Logging and audit features.
  • Adherence to the security framework (architecture, software development, contractual and regulatory aspects).
• Keep the central risk database up to date with the results of such risk assessment, ensuring that risks are documented and understood.
• Work closely with stakeholders to close the security gaps detected.
• Using the knowledge acquired from the above activities:
  • Participate in the update of the company cybersecurity risk register and cybersecurity company program.
  • Propose improvements in the security risk assessments methodology and tooling.
  • Propose improvements in the company information security framework and monitoring activities.

Skills:

• 5+ years’ experience in cybersecurity.
• Sound knowledge of cybersecurity risk assessments / management.
• Sound knowledge of security standards (such as ISO 2700x, NIST) and regulations.
• Master in cybersecurity, IT or equivalent experience.
• Fluency in English within a professional context (written and spoken).
• Cybersecurity certifications (CISSP, CISM, CRISC, SANS…) is a plus.

Soft Skills:

• Ability to manage a team of external consultants.
• Very good problem-solving, analytical, and communication skills.
• Ability to translate technical aspects into risks and to communicate on those risks.
• Strong integrity, rigor and proactivity are a must.
• Autonomous.

French version:

Vous êtes motivé(e) par la conception et la protection de systèmes d'information sécurisés et résilients ? Vous avez un fort intérêt pour la cybersécurité et souhaitez développer votre carrière dans ce domaine ? Nous étudierons ensemble comment nous pouvons accompagner votre développement dans ce rôle.

Principales responsabilités :

• Gérer le volet évaluation des risques du service « Security Assurance as a Service ». Veiller à ce que les livrables soient fournis dans les délais et avec le niveau de qualité attendu.
• Réaliser des analyses d’impact métier afin de déterminer le niveau de sécurité/disponibilité des solutions IT
• Participer à l’élaboration et au maintien du plan annuel d’évaluations de sécurité.
• Mener des évaluations approfondies des risques liés aux solutions IT, couvrant notamment :
  • L’identification des exigences spécifiques en cybersécurité.
  • La gestion des comptes et des mécanismes d’authentification.
  • La gestion des droits d’accès et la protection des données.
  • Les fonctionnalités de journalisation et d’audit.
  • La conformité au cadre de sécurité (architecture, développement logiciel, aspects contractuels et réglementaires).
• Maintenir à jour la base de données centrale des risques avec les résultats des évaluations réalisées, en veillant à ce que les risques soient correctement documentés et compris.
• Travailler en étroite collaboration avec les parties prenantes afin de corriger les écarts de sécurité identifiés.
• En s’appuyant sur les connaissances acquises lors des activités précédentes