Business Continuity and Risk Analyst

Keystone Solutions is seeking a consultant to evaluate, prioritize, and track cyber risks related to industrial systems and their IT dependencies present on public infrastructures managed by our client. This consultancy mission will involve working on-site and representing Keystone Solutions while addressing various challenges in a dynamic environment.

• Mapping & Inventory: Identify OT assets (PLC, RTU, HMI, field networks) and their IT dependencies in a unified CMDB. Identify SPOFs: Domain Controller, inter-network links, critical markets, firewalls, etc.
• Operational Risk Analysis: Apply the SPW methodology to model threats (tunnel shutdown, dam overflow, etc.), vulnerabilities, and impacts (safety of people, environment, availability, finances, image, etc.). Use concrete scenarios based on the SPW crisis experience from 2025.
• Treatment Plan & Prioritization: Develop an implementation plan for actions to address analyzed risks (reduction, avoidance, transfer, acceptance). Estimate cost/impact and create a risk reduction roadmap aligned with the operational continuity of systems. Communicate the complete risk management cycle.
• Project & Market Integration: Write IT/OT security clauses in specifications. Verify compliance of critical OT suppliers (automation maintenance, supervision).
• IT/OT Synergy & SOC: Translate OT risks into logging requirements and detection rules for the SPW SOC (use-case, automation control, etc.).
• Resilience & Exercises: Participate in restoration tests and OT/IT tabletop exercises to validate impact assumptions. Contribute to lessons learned and analyze root causes. Contribute to the continuous improvement of service continuity plans (PCA) and disaster recovery plans (DRP).
• Reporting & Governance: Maintain the OT risk register, prepare summaries for the Cyber MI Committee and for NIS2 audits (risk management policy).

• Service continuity plan and disaster recovery plan
• Detailed inventory of OT assets & IT dependencies (CMDB)
• OT risk register with scoring, scenarios, owners, and deadlines
• Mapping of zones & conduits + flow diagrams
• Prioritized treatment plan (24-month roadmap)
• Security requirement grids for OT purchases/upgrades
• Quarterly reports to the Coordinator: status of risks, progress, decisions to arbitrate

• Assertiveness and ability to be proactive
• Autonomous but enjoys teamwork
• Excellent communicator, client-oriented and results-driven
• Positive and caring attitude, active listening
• Ability to educate and simplify technical aspects
• Rigorous and methodical

If you are ready to tackle technical and strategic challenges in a dynamic consultancy environment, apply today at Keystone Solutions Career Portal.

• Communication & influence (vulgarisation pour dirigeants et équipes terrain) - Level: T1 - Junior - Most recent: Any time
• Connaissance des protocoles industriels de communication tels que Modbus, PROFINET, DNP3 ou équivalents.
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Connaissance des systèmes de contrôle-commande tels que les systèmes SCADA, PLC, RTU, DCS ou équivalents.
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Framework de cybersécurité (NIST, Cyberfundamentals)
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Méthodologies de gestion des risques (ISO 27005, IEC 62443-3-2, EBIOS RM)
• (mandatory) - Level: T2 - Confirmed - Most recent: Any time
• Normes et référentiels de sécurité de l’information (IEC 62443)
• (mandatory) - Level: T1 - Junior - Most recent: Any time
• Outils GRC & reporting
• (mandatory) - Level: T1 - Junior - Most recent: Any time

English
(mandatory)
Level Beginners (A1)
French
(mandatory)
Level Proficiency (C2)