Job description / Role
About the role
As a key player in ensuring confidence in our information security management system, you will be the overall guarantor of the security of our cloud administration infrastructure. You will join the security office and take on the role of delegated CISO for your area (also known as Business Security Officer service). As a Business Security Officer service (BSO service), you'll be constantly on the lookout for threats that could impact your area of responsibility, and your expertise will be the subject of industry-recognized certifications.
At the crossroads of the key issues for the success of the cloud (security and reliability), the Business Security Officer is involved in a wide variety of activities, for which the qualities of analysis and flexibility are essential.
Your mission is diverse and includes:
- Carry out expert assessment and consultancy work (risk analysis, pentesting, vulnerability audits, etc.);
- Ensure that Orange builds and operates the service in accordance with management's security requirements. Act as an expert security advisor to operational teams,
- Set up the necessary documentation and controls
- Report on the status of the service in terms of security
- Coordinate the management of security incidents
- Raise awareness among operational staff and remind them of the safety rules to be followed.
- Continuously improve Orange Cloud for Business security practices in conjunction with peers in a logic of control and continuous improvement (Plan-Do-Check-Act).
- Risk analysis, vulnerability analysis, security assurance plan and indicator monitoring
- Follow-up of external audits, implementation of security control points, reviews with cloud operational teams, awareness-raising for these same teams, security reviews, analysis of security incidents and architecture or process analyses for security improvement proposals
- Follow-up of action plans linked to the various controls and analyses carried out.
Requirements
About you
- 4/5 years of higher education (engineering school or Master's degree in IT), with a successful experience in cybersecurity.
- Fundamentals of security management organization such as ISO 27001 and ISO27002.
- Drawing up a Security Assurance Plan or Customer ISP, taking into account identified risks and ISO security recommendations.
- Fundamentals of EBIOS or other risk analysis stages
- Understanding and analyzing vulnerabilities
- Technical audits of IT systems (portals, configuration, flows)
- Technical architecture reviews and drawing up specifications for the implementation of technical security solutions (firewalls, probes, encryption, etc.)
- English is essential for this position and French would be a differentiating skill
- Ability to share, communicate and present
- Report facts and status to the customer, rigorously
- Explain, raise awareness, train operational teams
- Critical and constructive thinking
- Excellent analytical, writing and convincing skills
- Self-starter
Department
Global Delivery & Operations
Orange Business manages and integrates the complexity of international communications, freeing our customers to focus on the strategic initiatives that drive their business. Our extensive experience and knowledge in global communication solutions, together with our understanding of multinational business and local support in 166 countries and territories, ensure that our customers receive a consistent, global solution wherever they do business.
About the Company
Orange is one of the world’s leading telecommunications operators with sales of 43.5 billion euros in 2022 and 136,000 employees worldwide at 31 December 2022, including 75,000 employees in France. The Group has a total customer base of 287 million customers worldwide at 31 December 2022, including 242 million mobile customers and 24 million fixed broadband customers. The Group is present in 26 countries. Orange is also a leading provider of global IT and telecommunication services to multinational companies under the brand Orange Business.