Cyber GRC Specialist H/F

Sigma Suisse, based in Plan-les-Ouates, is a recruitment firm specialised in IT and strategic profiles, supporting influential players across French-speaking Switzerland.

Within the IT department, we work on needs in commodity and financial Trading, Pharmaceutical, Aeronautics, Space, Energy, Watchmaking and Swiss foundations.

Cyber GRC Specialist

We are supporting a global player in the search for a Cyber GRC Specialist. This is a 100% cyber role. You will ensure the cyber compliance of the group's affiliates (portfolio companies) and help maintain a high level of security across the group.

Key responsibilities:

• Ensure compliance with applicable laws, regulations and standards
• Develop, enforce and update security policies, standards and procedures
• Monitor and assess adherence to security guidelines across the group
• Conduct risk assessments, identify vulnerabilities and drive mitigation plans
• Track risk exposure and the effectiveness of mitigation actions, and report to management
• Maintain the information asset inventory and own the cybersecurity control catalog
• Lead internal security audits and respond to external audit requests
• Audit third parties (third-party risk and vendor management) and maintain the inventory of approved suppliers and tools
• Design and run security awareness initiatives, including phishing simulations, tailored to roles and departments
• Work with HR on the security aspects of the employee lifecycle (background checks, transfers, disciplinary actions, departures)
• Ensure the group's affiliates remain compliant with group cybersecurity policies and standards, with travel to their sites

Required profile:

• Minimum 5 years of experience in cybersecurity, with a focus on hands-on auditing, governance and risk management
• Ideal background in cyber audit or consulting (Big4), followed by a CISO or IT Risk team in a regulated environment (bank or large group)
• Solid understanding of regulatory requirements and industry standards (NIS2)
• Familiarity with CIS Controls, NIST SP 800-53, NIST CSF and ISO 27001
• Knowledge of modern security architecture best practices and incident response
• A plus: CRISC or CISA certification
• A plus: cloud security and group-level security requirements
• A plus: knowledge of data protection and awareness of the topic
• A plus: ability to coordinate or lead a small team