Information Security Officer

About the Company

Responsibilities

• ● Act as a member of the second line of defense, independently challenges and assesses how operational teams manage ICT and cyber risks, verifies control effectiveness, monitors remediation and provides clear reporting to management and governance bodies
• ● Implement the BRED Group technology risk management framework and translate Group requirements into local governance and processes.
• ● Coordinate ICT risk activities across BRED Group, BRED IT and APACA entities.
• ● Prepare ICT risk committee materials, dashboards and management reporting.
• ● Maintain ICT risk cartography, asset classification and risk information.
• ● Perform security risk assessments for projects, major changes and policy derogations.
• ● Plan and execute Level 2 permanent controls, assessing control design, effectiveness and supporting evidence.
• ● Document control results and monitor DRS remediation actions through effective closure.
• ● Independently challenge Level 1 controls while maintaining clear separation between lines of defense.
• ● Oversee incidents, vulnerabilities, patching, privileged access and penetration-testing remediation.
• ● Support audits, regulatory compliance, security awareness and local ICT risk contacts across APACA.

Requirements

• ● Minimum Bachelor's degree in Information Security, Computer Science, Information Technology, Risk Management, Audit or a related discipline.
• ● At least two years of relevant experience in ICT risk, information security governance, technology controls, IT audit or cybersecurity.
• ● Practical understanding of risk assessment, control testing, evidence review and remediation monitoring.
• ● Working knowledge of access, vulnerability, incident, change, resilience and third-party risk management.
• ● Banking or regulated-sector experience is preferred.
• ● CISA, CRISC, CISM, CISSP, ISO 27001 or equivalent certification is an advantage.
• ● Strong analytical and synthesis skills, with the ability to cross-check multiple sources of technical information and produce clear summaries for non-specialist audiences.
• ● Clear written and verbal communication, including governance presentations.
• ● Strong organization, attention to detail and disciplined follow-up.
• ● Good command in English.
• ● Good command in French is a plus.