CISO (Chief Information Security Officer)

English C1

We are looking for a Cybersecurity Manager (CISO) to join a stable project at one of our clients.

The working modality is hybrid with 70% on-site presence (Hortaleza area) and the rest teleworking.

• Strategy and Master Plan: Define, maintain, and execute the multi-year Cybersecurity Master Plan and its budget, aligned with the business and with NIS2, GDPR, and ISO 27001, and defend it before Management and the Board.

• Regulatory framework and compliance: Develop policies, standards, and procedures adapted to the group and its subsidiaries, including compliance with NIS2 in European locations.

• Risks, BIA, and business continuity: Govern risk management, BIA, and business continuity using the corporate GRC platform.

• OT and GxP Security: Lead plant security (SCADA, IT/OT segmentation, industrial directory) and compliance with 21 CFR Part 11 and EU GMP Annex 11, together with Quality and Production.

• Cloud security and corporate platforms: Direct the security of Microsoft 365, Entra ID, and Azure (conditional access, PIM, Defender, Intune, Purview) and of OCI, JD Edwards, and Salesforce (hardening, CIS); govern email security (SPF, DKIM, DMARC) and perimeter and remote access security (Fortinet FortiSASE / FortiGate, Front Door + WAF).

• Incidents and forensic analysis: Manage incidents (phishing, BEC, malware, compromised endpoints) with forensic reports and lessons learned, coordinating the outsourced SOC.

• DevSecOps and AI governance: Integrate security into the development lifecycle (S-SDLC, GitHub Enterprise) and define the architecture and governance of AI and the group's agentic systems (Microsoft Foundry, Copilot, Claude, MCP).

• Providers, audits, and awareness: Evaluate providers and third parties, draft security service specifications (CTI, SOC, pentest, audit), coordinate audits, define KPIs/KRIs for Management, and drive awareness (simulated phishing campaigns).

• Cloud and workstation: Microsoft 365, Entra ID (conditional access, PIM), Azure, Defender Suite, Intune, and Purview; OCI is desirable.

• Corporate applications: JD Edwards, Salesforce (hardening, CIS Benchmarks).

• Perimeter and network: Fortinet (FortiSASE, FortiGate), Azure Front Door + WAF.

• Security and monitoring: Sophos, Tenable Nessus, ELK, SIEM / SOC, CSPM.

• OT / Industrial: SCADA, MES, IT/OT segmentation (IEC 62443).

• Development: GitHub Enterprise, DevSecOps / S-SDLC.

• AI: Microsoft Foundry, Copilot, Claude, MCP (OWASP Top 10 for LLM).

• GRC: Corporate GRC platform; NIS2, GDPR, ENS, NIST CSF, ISO 27001, ISO 22301, ISO 42001 / AI Act frameworks are desirable.