IT&Data Risk & CS Manager

Job Overview:

• The Cyber Risk Manager is tasked with the ongoing identification, assessment, monitoring, reporting, and mitigation of cyber risks throughout the organization.
• This position ensures that cybersecurity risks are managed within the established risk appetite, that security controls remain effective, and that all regulatory and compliance obligations are fulfilled.
• In collaboration with IT Security Operations, Technology, Internal Control, Audit, Compliance, and Business teams, this role plays a critical part in safeguarding Danone's digital assets and enhancing the organization's cybersecurity resilience.

Primary Responsibilities:

• Cyber Risk Governance
• Develop and implement the Cyber Risk Management Framework along with relevant governance processes.
• Oversee the cyber risk register, ensuring that risks are accurately documented, assessed, and reviewed on a regular basis.
• Support risk governance committees and cybersecurity steering groups.
• Ensure that cyber risks are aligned with Enterprise Risk Management (ERM) standards and methodologies.
• Risk Assessment and Monitoring
• Perform cyber risk assessments for applications, infrastructure, cloud platforms, projects, and third-party services.
• Analyze emerging threats, vulnerabilities, and risk exposures that may affect business operations.
• Monitor risk treatment plans to ensure timely remediation of identified risks.
• Control Assurance and Compliance
• Manage security risk exceptions and assessments of compensating controls.
• Ensure compliance with cybersecurity frameworks, standards, and regulations such as e.g., ISO 27001, NIST CSF, CIS Controls, GDPR, DORA, and NIS2.
• Reporting and Stakeholder Engagement
• Create regular cyber risk reports and dashboards for management and leadership teams.
• Communicate cyber risk exposure, remediation progress, and trends to stakeholders.
• Work with Security Operations, Infrastructure, Application, Data, and Business teams to promote risk reduction initiatives.
• Serve as a trusted advisor on cyber risk matters for both business and technology stakeholders.

Technical Qualifications:

• Functional Technical Skills RN2
• 1 SK2
• 2
• Expertise in Cyber Risk Management and Risk Assessment methodologies.
• Comprehensive understanding of Information Security and Cybersecurity principles.
• Familiarity with Governance, Risk, and Compliance (GRC) processes.
• Experience with cybersecurity frameworks and standards, including ISO 27001, NIST, and CIS Controls.
• Basic knowledge of cloud security, infrastructure security, application security, and data protection concepts.
• Proven experience in preparing and advising businesses on effective mitigation strategies tailored to specific situations.
• Experience in managing risk registers, Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), and tracking remediation efforts.
• Strong skills in reporting, dashboard creation, and analytical assessment.
• Behavioral Competencies
• Excellent stakeholder management and influencing abilities.
• Adaptability to modify approaches, frameworks, and controls to suit specific business cases and associated risks.
• Exceptional communication and presentation skills.
• Analytical and problem-solving orientation.
• Capability to prioritize and handle multiple risks and initiatives simultaneously.
• Collaboration and teamwork in diverse global and multicultural settings.
• Meticulous attention to detail and commitment to governance.
• Desirable Skills
• Functional Technical Skills
• Experience with NIS2, GDPR, and other regulatory frameworks.
• Knowledge of Third-Party Risk Management (TPRM).
• Experience with cybersecurity risk management tools and GRC platforms such as ServiceNow GRC and Archer.
• Familiarity with Security Operations, Vulnerability Management, and Incident Response processes.
• Data analytics and reporting automation skills using Power BI, Tableau, and advanced Excel analytics.

Preferred Skills:

Technology->Cloud Security->AWS - GRC, Technology->Cloud Security->GCP - GRC, Technology->Risk Management->Risk Management System