CRI Group

Tasks
<ul>
<li>Support project teams in improving the security posture of systems they develop• Analyse SAST and DAST findings (initial triage with the team), performing code review of implemented corrections.• Promote secure development practices (e.g. OWASP TOP 10)• Lead threat modelling exercises with project teams• Improve management of secrets.• Define security requirements• Coordinate security of supply chain improvements• Take part in risk assessments.• Advance security enhancements in DevSecOps processes.• Animate the Security Champions community• Provision of security studies associated with information system projects• Coordination of compliance assessments for both on-prem and cloud applications• Support in definition and execution of the vulnerability management process• Security gap analysis• Evaluations of security products and tools for information systems• Assistance in the implementation of IS security policies• Security specifications for information systems• Management of security tests</li>
</ul>
Key Requirements:
Proven experience in Information Systems Development and Information Systems Security, preferably for Java EE technology (at minimum understanding the code and architectural blueprints, however hands-on programming experience is a plus)
• Good presentation skills (ability to chair large meetings)• Good knowledge of English (spoken, written)• IT Security certification (CISSP, CEH, GIAC or similar) is a plus
At least 1 certification among
• GCED (GIAC Certified Entreprise Defender)• GPPA (GIAC Certified Perimeter ProtectionAnalyst)• GCWN (GIAC Certified Windows SecurityAdministrator)• GCUX (GIAC Certified UNIX SecurityAdministrator)• GCCC (GIAC Certified Critical Controls)• SSCP ((ISC)2 Certified Systems SecurityPractitioner)• CAP ((ISC)2 Certified Authorization Professional)• CISSP (Certified Information Systems SecurityProfessional)• CISA (Certified Information Systems Auditor)• CISM (Certified Information Security Manager)• GSEC (GIAC Certified Security Essentials)• ECSA (EC-Council Certified Security Analyst)• SCPO (SABSA Certified Security Operations &amp;Service Management Practitioner)• ECSA (EC-Council Certified Security Analyst)• ISO 27001 Lead implementer• ISO 27001 Lead Auditor• ISO 27005 Risk Manager• or an equivalent certification recognizedinternationally (subject to acceptance)
Additional Requirements:
At least 1 certification in the field of incident handling:
• GCIH (GIAC Certified Incident Handler)• GCIA (GIAC Certified Intrusion Analyst)• ECIH (EC-Council Certified Incident Handler)• CSIH (SEI Certified Computer Security IncidentHandler)• SCMO (SABSA Certified Security Operations &amp;Service Management Specialist)• or an equivalent certification recognizedinternationally (subject to acceptance as a validcredential by the Contracting EU-I)
The following documents / procedures will be requested to successfully complete the hiring process :
<ul>
<li>A copy of your university degree(s)</li>
<li>A copy of your criminal record</li>
<li>Security Clearance Procedure</li>
</ul>
WHO WE ARE?
CRI company part of VASS Group, leads the digital transformation and cyber security in the European Union.
CRI operates serving the European Union Institutions, telecom operators, financial institutions and governmental bodies through a comprehensive offering of services and technologies.
Please visit our website and let's get in touch: <a href="https://cri-group.eu/" rel="noopener noreferrer nofollow ugc" target="_blank">www.cri-group.eu</a>

Brussel

Information System Security Analyst

DataDome

DataDome is one of the fastest-growing tech startups. We offer a cutting-edge technology that protects online businesses (websites and mobile applications) against advanced cyber attacks.
Based on AI &amp; Machine Learning, our cyber-security solution can detect &amp; block the most sophisticated bot attacks, in real-time.
We’re proud to protect more than 200 Companies worldwide, including TripAdvisor, The New-York Times, Foot locker Carrefour, BlaBlaCar, Rakuten, Veepee, Adevinta.
Our offices in Paris, New-York &amp; Singapour gather talents coming from 13 different nationalities. We all love our ideally located &amp; modern offices, an accessible management team, offsite events and weekly team-building initiatives, a chill room that includes football, video games and a punching bag!
DataDome is #CustomerCentric, the solution is the leader on <a href="http://g2.com" rel="noopener noreferrer nofollow ugc" target="_blank">g2.com</a> and 100% of our customers renew their subscription year after year.
Want to play your part in the war against bad bots? Join the team and become a Botbuster!
We operate at scale and handle over 1 000 billion events per day giving responses within 3ms (99p). Currently, we are present in more than 25 data centers around the world, deployed using Docker.
This stack is currently handling 500k requests per second and manages more than 300 TB of data.
Why Join us?
You want to do practical security work in a scale-up company whose core business is cyber-security with a challenging stack in a multi-cloud environment.
Your team:
As a Security Engineer - GRC (Governance, Risks, and Compliance) focusing to preserve DataDome's information assets, customer data, DataDome employees and keeping compliance requirements .
You will be a strategic point of contact and you will work closely with information security, legal, engineering, product and human resources to improve continuously the company's security posture.
You will be more specifically in charge of:
Conducting security risk assessment and improving the process and the methodology.
Contributing to the implementation of the "security by design" pattern in projects, ensuring security action plans, measures and controls are in place in all projects.
Creating training to raise security awareness.
Maintaining security policies, procedures, action plans, performing audits and reviews, third-party &amp; vendor management and monitoring compliance progress.
Supporting tooling and automation roadmaps that facilitate compliance activities and lead to reducing the disruption of audit events.
Contributing to the improvement of the DataDome Real-Time Bot Protection solution.
Requirements:
You believe in the importance of a risk-based approach to defining and maintaining security objectives, policies and procedures for succeeding in your mission.
You have a real understanding and experience in Cloud security (AWS or GCP)
You are really interested in technical topics, you know how Internet works.
You know industry compliance (SOC2) and/or security standards including (CIS benchmark).
Strong written and verbal communication skills in French and English.
Bonus:
Your skills are recognized by a certification CISSP, CCSP, ISO 27001 Lead Implementer or Auditor, EBIOS Risk Manager, Risk Manager ISO 27005
You are able to be “hands-on”.
What we offer if you join our team :
<ul>
<li>A stimulating work environment with passionate individuals and a talented R&amp;D team creating innovative solutions, making DataDome one of the strongest performers in the bot protection industry.</li>
<li>A multicultural and diverse team with almost 13 different nationalities in the office!</li>
<li>A joyful workplace with many events throughout the year: annual offsite, summer and Christmas parties; one thematic aperitif per month, breakfast every Friday morning...</li>
<li>Remote friendly work environment: Tailor-made work from home policy and joyful workplace located in Paris close to Opéra station!</li>
<li>A Swile card and Alan Healthcare</li>
</ul>
What are the next steps?
You x Talent Acquisition Manager: first interview and cultural fit
You x the Team's Engineering Manager: technical and cultural fit + Take-home technical challenge
You x Team: Presentation and review of your "technical proposal" with the team
You x Member of the leadership team - Discussion about Datadome vision and "raison d'être" ? NOW you really met everyone
Welcome to DataDome :)
DataDome is an equal opportunity employer, and proud to be committed to diversity and inclusiveness. We will consider all qualified applicants without regard to race, color, nationality, gender, gender identity or expression, sexual orientation, religion, disability or age.

France

Security Engineer - Governance, Risk &amp; Compliance w/m

Lyft

At Lyft, our mission is to improve people’s lives with the world’s best transportation. To do this, we start with our own community by creating an open, inclusive, and diverse organization.
Lyft’s engineering team is growing rapidly, and we are looking for a Security Assurance Analyst to help us scale our risk and compliance programs. Our drivers and passengers entrust Lyft with their personal information and travel details to get where they are going and expect us to keep that data safe. Lyft’s Customer Trust team ensures that appropriate data protections are applied to meet our compliance requirements and customer contractual commitments. We conduct security risk assessments, consult with organizational stakeholders, monitor and continuously improve Lyft’s Information Security program, facilitate third party security audits, work with engineering teams to implement, automate, and monitor security controls, develop policies, and advise on all matters related to information security assurance.
As a member of the Customer Trust team you will help ensure that we meet and deliver against our enterprise promises and contractual commitments to customers on security and privacy. You’ll meet and work with stakeholders across the company working on exciting new projects, scale our program through the development of efficient processes and automation, conduct risk assessments, and serve as a trusted advisor to teams across Lyft on issues related to technical compliance.
Responsibilities:
<ul>
<li>Assist with all aspects of executing on third-party audits such as SOC 2, HIPAA, NIST 800-171, NIST CSF, and PCI assessments.</li>
<li>Build strong cross-functional relationships with product and engineering teams and advise on complex compliance-related requirements.</li>
<li>Operationalize a Security Risk Management Framework ensuring all security risk related activities are managed accordingly</li>
<li>Communicate risk to both technical and non-technical stakeholders across the business and negotiate risk mitigation strategies.</li>
<li>Develop and maintain internal infosec policies, guidelines, and best practices for Lyft.</li>
<li>Gather and organize assessment data and results to support risk reporting and monitoring processes.</li>
<li>Contribute to the development of controls and continuous testing, and design remediation and risk mitigation solutions.</li>
<li>Collaborate cross-functionally to establish high levels of automated testing and evidence collection as well as contribute to the development of tools and automation.</li>
</ul>
Experience:
<h4>Security superstars come from many backgrounds. We encourage you to apply even if you do not match this list perfectly.</h4>
<ul>
<li>Knowledge of regulatory compliance and related assessments/certifications including SOC 2, HIPAA, NIST 800-171, NIST CSF, and PCI.</li>
<li>5-7 years experience in security governance, risk, and compliance</li>
<li>Knowledge of and experience with security and security risk standards and frameworks, especially ISO 27005 and the NIST Risk Management Framework</li>
<li>Strong technical background and ability to negotiate effectively with engineering teams</li>
<li>Strong cross-functional communication and leadership skills, with the ability to initiate and drive projects proactively</li>
<li>Strong teamwork and collaboration skills</li>
<li>Strong written and verbal communication skills</li>
<li>Ability to own and manage high priority projects and multiple tasks</li>
</ul>



Responsabilidades:
<ul>
<li>Asistir con todos los aspectos de la ejecución de auditorías de terceros, como evaluaciones SOC 2, HIPAA, NIST 800-171, NIST CSF y PCI.</li>
<li>Construir sólidas relaciones multifuncionales con los equipos de producto e ingeniería y asesorar sobre requisitos complejos relacionados con el cumplimiento.</li>
<li>Poner en funcionamiento un marco de gestión de riesgos de seguridad que garantice que todas las actividades relacionadas con los riesgos de seguridad se gestionen en consecuencia.</li>
<li>Comunicar los riesgos a las partes interesadas técnicas y no técnicas en todo el negocio y negociar estrategias de mitigación de riesgos.</li>
<li>Desarrollar y mantener políticas internas de seguridad de la información, lineamientos y mejores prácticas para Lyft.</li>
<li>Recopilar y organizar los datos y los resultados de la evaluación para respaldar los procesos de monitoreo e informes de riesgos.</li>
<li>Contribuir al desarrollo de controles y pruebas continuas, y diseñar soluciones de remediación y mitigación de riesgos.</li>
<li>Colaborar de manera interfuncional para establecer altos niveles de pruebas automatizadas y recopilación de evidencia, así como contribuir al desarrollo de herramientas y automatización.</li>
</ul>
Experiencia:
<h4>Los superestrellas de la seguridad tienen diferentes orígenes. Les recomendamos que presenten su solicitud incluso si no coincide perfectamente con esta lista.</h4>
<ul>
<li>Conocimiento del cumplimiento normativo y evaluaciones/certificaciones relacionadas, incluidos SOC 2, HIPAA, NIST 800-171, NIST CSF y PCI.</li>
<li>5 a 7 años de experiencia en seguridad, riesgo y cumplimiento.</li>
<li>Conocimiento y experiencia con estándares, marcos de seguridad y riesgo de seguridad, especialmente ISO 27005 y el marco de gestión de riesgos NIST.</li>
<li>Sólida formación técnica y capacidad para negociar eficazmente con los equipos de ingeniería.</li>
<li>Fuertes habilidades de liderazgo y comunicación interfuncional, con la capacidad de iniciar e impulsar proyectos de manera proactiva.</li>
<li>Gran trabajo en equipo y habilidades de colaboración.</li>
<li>Fuertes habilidades de comunicación escrita y verbal</li>
<li>Capacidad para administrar proyectos de alta prioridad y multitasking</li>
</ul>

Mexico City

Security Assurance Analyst, Customer Trust

Apply to Iso 27005 Cyber Security Jobs in companies remotely and near you. New Iso 27005 Cyber Security Jobs added daily.

Job Position and Company	Location	Tags	Posted
Information System Security Analyst at CRI Group	CEH CISA CISM Cissp Clearance
Security Engineer - Governance, Risk & Compliance w/m at DataDome	Audits Automation AWS CCSP Cissp
Security Assurance Analyst, Customer Trust at Lyft	Audits Automation Golangvernance Hipaa Iso 27005

Iso 27005 Cyber Security Jobs

0 Iso 27005 Cyber Security Jobs. Page 1 of 1

3 closed iso 27005 cyber security jobs:

Subscribe to the weekly
Cyber Security Jobs Newsletter

Iso 27005 Cyber Security Jobs

All Cyber Security Jobs

Cyber Security Jobs by Category

Iso 27005 Cyber Security Jobs

0 Iso 27005 Cyber Security Jobs. Page 1 of 1

3 closed iso 27005 cyber security jobs:

Subscribe to the weekly Cyber Security Jobs Newsletter

Iso 27005 Cyber Security Jobs

All Cyber Security Jobs

Cyber Security Jobs by Category

Subscribe to the weekly
Cyber Security Jobs Newsletter