About the mission
We are looking for an experienced Cybersecurity GRC Manager to lead governance, risk management, and compliance efforts for our organization and its cooperative clients. The ideal candidate will have a strong background in ISO 27001 and NIS2 compliance, along with excellent communication and project management skills.
Read the full description
Context
Digit'Eaux is the reference partner for stakeholders in the water sector in Wallonia for their digital transformation projects, notably supporting SWDE, SPGE, and several Approved Sanitation Organizations (OAA).
Recognized as an essential entity under the NIS2 directive, Digit'Eaux is involved in the design, coordination, and implementation of structuring IT projects, while also supporting its cooperators upstream in defining their governance and IT risk management strategy.
In this context, the cybersecurity division of Digit'Eaux wishes to engage the services of an experienced GRC Manager, responsible for structuring and leading governance, risk management, and compliance efforts (NIS2, ISO 27001) for Digit'Eaux and the cooperators in the water sector (sanitation and drinking water).
The consultant will join the internal cybersecurity team and closely collaborate with the CISO and the teams and subcontractors of Digit'Eaux.
Mission
As part of ensuring compliance for Digit'Eaux and its cooperative clients regarding NIS2 regulatory requirements and ISO 27001:2022 standards, the Cybersecurity GRC Manager will strengthen the security team led by the CISO.
He/She will take charge of operational governance, risk management, and compliance (GRC) activities, directly supporting the CISO and interfacing with clients in the MSP portfolio:
Lead and draft the Information Security Management System (ISMS) documentation: policies, procedures, risk treatment plans.
Support clients in their ISO 27001 certification process, from gap analysis to certification audit.
Ensure preparation for internal and external audits, follow-up on non-conformities, and continuous updating of the ISMS.
Contribute to the implementation of NIS2 compliance for essential and important entities within the scope.
Use and manage the GRC tool CISO Assistant (or equivalent) for tracking controls, risks, and action plans.
Skills
Soft Skills
Document rigor: Ability to produce precise, coherent, and maintainable documentation over time — policies, procedures, risk treatment plans written without ambiguity.
Oral and written communication: Ability to express oneself clearly to various stakeholders (management, Comex, technical teams, client business leaders) and to draft summaries and presentations for management bodies. Ability to adapt the language level according to the audience — to simplify without oversimplifying.
Active listening and relational intelligence: Ability to understand the real constraints of clients and subcontractors, reformulate their needs, and establish a climate of trust conducive to co-constructing security procedures and processes.
Negotiation and influence without hierarchical authority: Ability to advance compliance topics with stakeholders who are not under Digit'Eaux's direct authority — cooperative clients, third-party providers, external IT teams. Knowing how to defend a security requirement while remaining constructive and solution-oriented.
Teaching ability: Ability to make ISO 27001 and NIS2 requirements accessible to non-specialist operational staff, to conduct collaborative working workshops (risk workshops, document reviews, awareness), and to engage stakeholders in the compliance process.
Resistance management and change management: Ability to manage organizational resistance to compliance requirements, identify the right internal contacts at the client, and transform regulatory constraints perceived as obstacles into operational improvement levers.
Autonomy and proactivity: Ability to advance independently on GRC workstreams, regularly reporting to the CISO and escalating blocking points at the right time.
Results orientation: Focus on concrete deliverables: written policies, prepared audits, closed non-conformities.
Adaptability: Comfortable in a multi-client MSP environment with high operational responsibility, able to juggle between different organizational contexts and varying security maturity levels.
Governance Skills
Mastery of the PDCA cycle applied to an ISMS (ISO 27001).
Ability to draft and maintain a Statement of Applicability (SOA) with contextualized justifications.
Knowledge of NIS2 requirements (essential/important entities, notification obligations, security measures).
Experience in conducting risk analyses (ISO 27005 or equivalent).
Ability to interact with client CISOs and position Digit'Eaux as an extended operational security team.
Awareness of GDPR obligations and their articulation with ISO 27001 / NIS2 requirements.
Technical Skills (functional/management level)
ISO 27001:2022: mastery of the 93 measures of Annex A, clauses 4 to 10, and audit requirements.
Document drafting: security policies, operational procedures, risk treatment plans, audit reports.
Project management: planning compliance milestones, tracking action plans, Comex reporting.
GRC tools: CISO Assistant, or any equivalent GRC platform (OneTrust, ServiceNow GRC, Archer…).
IT culture and infrastructure security: solid understanding of fundamental concepts of information system and network security, necessary to assess the relevance of controls and effectively communicate with technical teams.
Knowledge of MSP environments and critical IT architectures (OT/IT, water sector or equivalent appreciated).
Use of complementary frameworks: CIS Controls, IEC 62443, ANSSI sectoral guides.
Experience
Minimum 3 to 5 years of experience in a GRC, IT Compliance, or Information Security role.
Proven experience in conducting or supporting ISO 27001 certification (participation in at least one complete cycle: preparation, mock audit, certification audit), a Lead Implementer ISO27001 certification is a plus.
Experience in an MSP context, consulting firm, or multi-client environment appreciated.
Exposure to regulated sectors (critical infrastructure, water, energy, health, finance) considered an asset.
Good practice of the French language in writing (intensive document production); technical English is a plus.
The mission is subject to renewal based on client assessment.
What you'll do
- Lead and draft the Information Security Management System (ISMS) documentation: policies, procedures, risk treatment plans.
- Support clients in their ISO 27001 certification process, from gap analysis to certification audit.
- Ensure preparation for internal and external audits, follow-up on non-conformities, and continuous updating of the ISMS.
- Contribute to the implementation of NIS2 compliance for essential and important entities within the scope.
- Use and manage the GRC tool CISO Assistant (or equivalent) for tracking controls, risks, and action plans.
What we're looking for
- Minimum 3 to 5 years of experience in a GRC, IT Compliance, or Information Security role.
- Proven experience in conducting or supporting ISO 27001 certification.
- Experience in an MSP context, consulting firm, or multi-client environment appreciated.
- Exposure to regulated sectors (critical infrastructure, water, energy, health, finance) considered an asset.
- Good practice of the French language in writing; technical English is a plus.
Skills
- ISO 27001:2022
- CISO Assistant
- OneTrust
- ServiceNow GRC
- Archer