Cybersecurity - Vulnerability Management & Third-Party Risk

At the heart of the Cybersecurity team and IT transformation, the JOB HOLDER is responsible for vulnerability management activities and controlling third-party risks. As a true technical and methodological reference, they maintain server vulnerability management tools (SAST / DAST) and supply chain assessment solutions (Third-Party Risk Management). Drawing on Lean Management principles and a continuous improvement approach (Security, Quality, Lead Time, Cost), they collaborate closely with IT, DevOps, and business teams to embed security as early as possible in operational and application lifecycles.

Missions

Server Vulnerability Management & Patching

• Deploy and supervise automated vulnerability scanning across the entire server estate.
• Define and drive a risk-based remediation schedule, prioritizing the mitigation of critical and high vulnerabilities.
• Achieve and maintain a compliance rate for up-to-date servers in accordance with established security standards.

Application Security & DevSecOps Integration (SAST / DAST)

• Administer application security analysis solutions (SAST and DAST) within CI/CD pipelines.
• Define and enforce test coverage thresholds (e.g., SAST coverage ≥ 80% on critical applications and systematic DAST scans prior to production release).

Third-Party & Vendor Risk Management (TPRM)

• Design and formalize a standardized third-party security assessment framework (questionnaires, audits, scorecards).
• Drive remediation plans to ensure that 90% of high-risk vendors address their non-conformities.
• Establish a continuous monitoring system for the security posture of key partners (periodic reviews, real-time alerts, automated compliance).

Operational Excellence & Collaboration (Cross-functional)

• Apply Lean methodologies to eliminate waste and optimize the efficiency of cybersecurity processes without resource overconsumption.
• Identify and eradicate root causes of operational failures and bottlenecks.
• Foster seamless synergy and a partnership of trust between IT, Project, and Cybersecurity teams.

Deliverables

• Vulnerability impact reports (impacted assets, severity, etc.)
• Vulnerability remediation schedules
• Fully functional SAST, DAST, and TPRM tools
• Partner security posture assessment reports

Profile

Experience: Minimum of 5 years of experience in a similar role (Operational Security Engineer, Vulnerability Management Lead / Third-Party Risk Lead).

Technical Skills:

• Strong expertise in infrastructure scanning tools and patch management strategies.
• Proven mastery of SAST / DAST tools and methodologies, along with their integration into CI/CD pipelines.
• Solid command of third-party assessment and risk management frameworks.

Methodology & Mindset:

• Knowledge of or strong interest in continuous improvement and Lean methodologies (waste reduction, productivity optimization).
• Analytical mindset, rigor in tracking metrics/KPIs, and a risk-based sense of prioritization.
• Influential leadership, strong communication/teaching skills, and the ability to unite cross-functional teams (DevOps, IT Ops, Procurement).

Languages: Professional English is mandatory for this international context.

600 € jour