The role in brief
Via.io is looking for a cybersecurity engineer. The role covers the companies of the Via.io group. The successful candidate leads ISO 27001 governance and is its IAM expert. They are also the technical security lead for the companies' SaaS products, from design to operations. The role is half technical; the other half covers ISO 27001 governance and GDPR.
Who you work with
A cross-functional role across all the group's companies, in close contact with the R&D and Ops teams.
First priorities
Getting to grips with Keycloak, at the heart of authentication and authorisation for Apizee's products; keeping the ISO 27001 certification.
Missions
Three missions shape the role; the shares of time are indicative.
≈ 50 %ISO 27001 governance and GDPR
- Own the IAM part of the ISMS: identity and access management policy, password policy, access, joiner and leaver procedures. Run periodic reviews of access rights on critical assets, keep the unified identity and access register up to date, and track its indicators.
- Automate these reviews with Assets Guardian, an open-source tool (Python) published by Apizee: connectors, rules engine, reports and alerts.
- Contribute to every part of ISO 27001: risk analysis (EBIOS RM), platform monitoring and resilience, security incident management, and more.
- Handle security audit findings and help build the remediation plan for the non-conformities identified.
- Handle technical GDPR requests, such as the right to erasure, and keep the record of processing activities up to date.
- Design and run awareness actions for all employees (simulated phishing campaigns, presentations).
- Detect and handle security incidents: work through alerts from several sources (SOC and EDR), analyse the logs centralised in ELK and monitoring results, then coordinate the technical response (qualification, remediation strategy, debrief).
≈ 25 %IAM and Keycloak
- Administer the Keycloak instances in every environment: version upgrades (Keycloak, PostgreSQL) and configuration hardening.
- Audit the configuration of realms, clients, connections to third-party identity providers and, more broadly, authentication flows (OpenID Connect, SAML 2.0, OAuth 2.0).
- Evolve the authorisation model of Apizee's products, delegated to Keycloak (PBAC, FGAC, RBAC, ReBAC; Keycloak Authorization Services).
- Provide level 2 and 3 support on Keycloak, in particular on SSO connections, and support integrations for key accounts.
- Build tooling to administer Keycloak: migrations and realm compliance checks.
- Administer the IAM side of Microsoft 365 (Microsoft Entra ID): accounts, contractor access, SSO for third-party applications, hardening and audits.
- Administer identities and access in GitLab: accounts, contractor access, hardening and audits.
- Control identities and access across the internal IT tools, following the principles of least privilege and need-to-know.
≈ 25 %Product and hosting security
- Act as the security lead for the R&D teams (Security by Design and Privacy by Design), from the design of a product or feature to its release: software architecture, access segregation, cryptographic choices, CI/CD security and data minimisation (GDPR).
- Act as the security lead for the Platform/Ops team on hosting: deploying security solutions (WAF, secrets management, EDR), cryptographic choices, monitoring and Kubernetes architecture.
- Train the R&D and Platform/Ops teams in secure development and operations.
- Turn the security requirements of key accounts into action plans, and help answer security questionnaires and tenders.
- Keep a close watch on threats and vulnerabilities across the companies' whole technology environment (products, hosting, internal tools): assess their impact and trigger updates or fixes with the teams concerned.
Who we're looking for
The role suits a security engineer with a GRC and IAM focus, able to build their own tools to automate whatever can be automated in a human-sized company.
Essential skills
- Identity protocols (OAuth 2.0, OpenID Connect, SAML 2.0, JWT, PKCE) and administration of an identity provider, ideally Keycloak.
- Solid grounding in ISO 27001 governance (building an ISMS), risk analysis (EBIOS RM, for example) and GDPR.
- Microsoft 365 administration, mainly Microsoft Entra ID (Microsoft Intune is a plus).
- Web application security: OWASP Top 10, authentication and authorisation, secrets management, and so on.
- Scripting and tool development in Python and/or PowerShell, consuming REST APIs.
Nice to have
- DevSecOps: GitLab CI/CD, Docker, Kubernetes.
- ISO 27001 Lead Implementer certification.
- Web development in JavaScript/TypeScript on Node.js frameworks.
Soft skills
- Writing skills: drafting policies and procedures for ISO 27001.
- Teaching skills: raising awareness of cybersecurity among R&D, Ops, sales teams and management.
- Advisory stance: balancing security requirements and business needs without blocking projects.
- Autonomy and rigour in documentation: tracing and proving, as ISO 27001 requires.
How to apply
Employer: Via.io. Scope: the companies of the Via.io group. The role is based at 152 boulevard Pereire, 75017 Paris.
Apply at jobs@via.io