Global Cybersecurity Risk Manager

Hello, we’re L’Oréal. We're not just building brands, we're shaping how the world experiences beauty (and it takes a lot of cool jobs to do it). Intrigued? Keep reading, this might be the opportunity you've been searching for.

A Day in the Life

Cybersecurity is the fundamental pillar of L’Oréal’s digital business resilience. Reporting to the Head of Cyber Governance, Risk & Compliance, your mission is to architect and participate to the L'Oréal’s Risk-Based Cyber Transformation. You will bridge the gap between technical posture and business impact by moving the cyber organization toward a data-driven cyber risk management model.

Within the Group Cybersecurity Governance, Risk and Compliance team you will:

Strategic Decision Support & Intelligence

• Act as a strategic partner for the leadership team, translating technical cyber indicators into a clear business risk posture.
• Define and operationalize the Group’s cyber risk appetite statements, ensuring business decisions remain within agreed security thresholds.
• Design and deploy a dashboard of Key Risk Indicators (KRIs) to provide a comprehensive view of global risk exposure.
• Deliver and present global cyber heatmaps, highlighting critical exposure points and progress against risk reduction targets.

Global Consistency & ERM Integration

• Ensure the seamless integration of cybersecurity risks into the Group ERM (Enterprise Risk Management) methodology, providing a consistent language for risk reporting at the highest level.
• Harmonize and synchronize cyber risk processes by leading a consistent "One CSRM" program worldwide.
• Drive the convergence of GRC processes into a unified global risk calculation engine.

Operational Risk & Process Excellence

• Crown Jewels Security: Ensure specific risk frameworks are applied to the most critical business assets.
• TPCRM Leadership (Third-Party Cyber Risk Management): Oversee the global strategy for managing supply chain and vendor risks. Ensure that third-party exposure is quantified and mitigated in line with the Group’s risk appetite.
• CIP (Cyber Into Project): Manage the deployment and enhancement of the CIP process.

Advanced Analytics & Strategic Foresight

• Design and frame predictive risk assessment models to provide management team with strategic foresight.

Leadership, Coaching & Operational Excellence

• Direct management of the global cyber risk management team.
• Act as a cyber risk liaison with relevant stakeholders.
• Architect the integration of disparate security data sources into a centralized GRC tool.
• Participate to the GRC global technology roadmap by selecting and implementing tools that support the transition from manual, point-in-time assessments to an automated, continuous risk monitoring platform.

We Are Looking For

First and foremost, we love people that are curious, collaborative, eager to have an impact, proactive and who value innovation, autonomy, and team spirit.

Secondly, in this specific position, it will be important for you to have:

• Education: Master’s degree in Information Technology.
• Professional experience: You are highly experienced in GRC with a significant experience in cybersecurity risk management, within a consultancy firm or a Fortune 500 company.
• Technical skills:
  • Experience in architecting or maturing risk management program.
  • Ability to communicate risk credibly to both technical and non-technical audiences.
  • Deep working knowledge of security frameworks and regulations (GDPR, NIS2 and CRA).
  • Strong capability to translate the evolving threat landscape into specific business risks.
  • Certifications (CRISC, CISM, CISSP) are a plus.
• Management skills:
  • Ability to manage internal and consultancy teams.
  • Ability to communicate complex ideas effectively, in English and French, with international stakeholders and with Cybersecurity stakeholders within the Group.
• Interpersonal skills:
  • Willingness to learn and develop new hard and soft skills.
  • Ability to navigate within a fast-moving environment.
  • Strong analytical skills.
  • Ability to lead workshops.
  • Fluency in English is essential.
  • Position based at St-Ouen (93) with regular meetings within Paris area and rare business trip abroad.

What’s In It For You

• A place for you to leave your comfort zone and grow beyond your potential (here, you’ll be encouraged to try new things and take risks!)
• Real responsibility from day 1, there’s no sitting on the sidelines at L’Oréal
• An environment where people of every ethnicity, social background, age, religion, gender and sexual orientation as well as people with disabilities are accepted, can speak up, will thrive and are celebrated!
• A place where you can contribute to something bigger! Many of our brands have societal /environmental causes to make concrete difference

Who We Are

L’Oréal is present in 150 markets on five continents. For more than a century, L’Oréal has devoted itself solely to ‘Create beauty that moves the world’; it is now the industry world leader with €42 billion consolidated sales. Together, we solve complex challenges at scale, while making sure we stay committed to making the world a more inclusive and a better place for everyone & our planet.

Today, L’Oréal includes over 9k experts in beauty tech, digital, data and e-comm and is constantly growing. Championing Beauty Tech, we invent the beauty of the future while becoming the company of the future. To achieve this ambition, L’Oréal continues to recruit diverse, innovative, skilled, and passionate minds in different tech domains such as Data, Digital, Cloud, Cyber Security, IT Architecture, DevOps, Applications, and Infrastructure.

We’re committed to guaranteeing inclusive recruitment processes and to advocating for hiring and promoting each candidate in an ethical and equitable way. The Group strictly prohibits discrimination against any applicant for employment because of the individual’s gender identity or expression, sexual orientation, visible and/or invisible disabilities, socio-economic and/or multicultural origins, health conditions, age, religion, or any other characteristics protected by law.