EQUANS

Equans is a world leader in the energy and services sector, with annual revenues of nearly €19,2 billion* and almost 800,000 projects.​

Equans has leading positions in Europe, which is the result of the history of energy construction in these countries, and strong presences in North and South America and in Oceania.​

With nearly 90,000 highly skilled employees, Equans has a strong geographic footprint, anchored by historic local brands. Equans provides its customers with excellent technical expertise in the design, installation, maintenance and operation of multi-technical facilities. This know-how is based on key skills. First of all, in electrical and thermal engineering – two strong points that help accelerate the reduction of our clients’ carbon footprint – but also in ventilation, refrigeration, mechanics and robotics, fire protection, energy renovation, digital solutions, IT, cyber security and telecommunications.​

The combination of this expertise allows us to offer efficient and optimised solutions at all stages of the energy chain, from production, storage and transport to usage.

(*) Turnover 2024 consolidated

SLS ERP S-CISO

GENERAL OVERVIEW

Equans has established a global ERP Shared Line of Service (SLS), structured around two key platforms—SAP and Microsoft Dynamics. Its mission is to drive value from ERP systems by adopting new technologies, promoting best practices, and aligning with business goals.

SLS acts as a strategic partner to the business, offering leadership, governance, and a unified ERP roadmap. It fosters a global ERP community, sets security and operational standards, and ensures consistent programme and project oversight.

The service aims to boost productivity by sharing expertise, reducing duplication, and identifying opportunities for convergence and transformation.

It supports around 32,000 ERP users worldwide, offering a wide range of functional and technical services.

Summary of the role

In this role, you will report jointly to the SLS ERP Director and the Global SLS CISO and form part of the SLS ERP Senior Leadership Team.

As the SLS ERP S-CISO, you will lead cybersecurity governance, risk oversight and independent challenge across Equans’ global SAP and Microsoft Dynamics environments. You will be accountable for achieving and maintaining ISO/IEC 27001 certification for SLS ERP and for embedding proportionate security requirements into ERP strategy, architecture, services and transformation programmes.

Working with SLS ERP leadership, Equans Cyberdefense, local CISOs, ERP teams and strategic partners, you will coordinate risk assessments, assurance, audits, incident readiness and remediation. You will set direction and challenge control effectiveness, while operational teams remain responsible for implementing and operating their controls.

We are looking for someone with strong cybersecurity expertise, practical experience of complex international environments and the ability to constructively influence senior, technical and operational stakeholders.

We offer a flexible working environment, with periodic international travel expected.

KEY METRICS OF THE ENVIRONMENT

• SAP, MS Dynamics
• 32,000 ERP users
• 11 ERP landscapes
• 20,000+ tickets
• Europe, LATAM, Canada
• English, French, Spanish

Key Objectives & KPIs

• ISO/IEC 27001 Certification: Achieve and maintain certification for SLS ERP, ensuring that governance, resources, evidence and remediation plans are in place.
• Cyber Risk management: Ensure that ERP risks are identified, owned and treated, and that controls, audits and material remediation are independently monitored.
• Security by Design: Embed security requirements in strategic programmes, architecture decisions, technical changes and the onboarding of new entities.
• Monitoring & Incident Readiness: Maintain effective ERP monitoring, detection and incident-response arrangements with Equans Cyberdefense, ERP teams and service providers.
• Leadership Reporting: Provide concise KPI, KRI, roadmap and threat reporting to support timely management decisions.

KEY RESPONSIBILITIES

Cybersecurity Governance & Strategy

• Own the SLS ERP cybersecurity governance framework and roadmap for SAP and Microsoft Dynamics, aligned with Group policies, the ERP operating model and business priorities.
• Be accountable for achieving and maintaining ISO/IEC 27001 certification for SLS ERP, while operational owners implement, operate and evidence the required controls.
• Translate Group requirements into practical ERP standards, decisions, exceptions and escalation paths.
• Represent SLS ERP in cybersecurity governance and promote a pragmatic, risk-based approach that supports secure delivery.

Cyber Risk Management

• Apply the Group cyber risk framework across ERP applications, services and projects, ensuring that risks have authorised owners and proportionate treatment plans.
• Provide independent advice on risk acceptance, compensating controls and remediation priorities.
• Maintain oversight of material risks, emerging threats and overdue or unacceptable exposures, escalating them through the appropriate governance.

Security Architecture & Projects

• Act as the cybersecurity authority for strategic ERP programmes, architecture decisions and significant technical changes.
• Ensure that security requirements are reflected in designs, plans, technical standards, onboarding activities and go-live criteria.
• Challenge material deviations and require remediation, formal risk acceptance or escalation where requirements are not met.

Security Assurance plans & Compliance

• Maintain a risk-based assurance plan covering SLS ERP teams, cloud and managed service providers, strategic partners and other third parties.
• Coordinate ISO/IEC 27001 assessments, audits, evidence collection, management responses and remediation follow-up, ensuring that control owners fulfil their responsibilities.
• Coordinate penetration tests and technical audits, ensuring that intrusive activities are properly scoped, authorised and controlled.

Vulnerability & Security Posture Oversight

• Define a risk-based method for assessing SAP, Microsoft Dynamics and supporting technology vulnerabilities in the context of Equans’ exposure and business impact.
• Monitor material vulnerabilities, security weaknesses and remediation exceptions without taking over technical patch implementation.
• Govern and challenge the monthly SAP Security Note process, including assessment quality, MBU responses, remediation deadlines, required downtime windows and escalation of missed targets.
• Challenge priorities, identify recurring issues and ensure that improvement plans are owned and escalated where necessary.

Identity & Access Security Oversight

• Provide governance and independent challenge for ERP identity and access management, including privileged access, critical authorisations, segregation of duties, emergency access and periodic reviews.
• Oversee the effectiveness of joiner, mover and leaver controls, including partner-to-internal transitions, timely removal of access and the prevention of retained or duplicate access across identity changes.
• Ensure that temporary and privileged access is appropriately authorised, time-bound, monitored and periodically re-certified by accountable owners.
• Work with the Identity & Access Lead to oversee material deficiencies, exceptions, risk ownership and remediation, and support related assurance and audits.

Data Protection & Sensitive ERP Information

• Define and oversee governance for ERP data classification, retention, encryption and the secure handling of sensitive production information across applications, interfaces and third parties.
• Provide independent challenge over production-data extracts, non-production data masking and access by SLS ERP teams, partners, audit tools and other external services.
• Ensure that material data-protection risks, exceptions and control gaps are owned, remediated or formally accepted and escalated through the appropriate governance.

Security Monitoring & Incident Management

• Define ERP monitoring and detection requirements and work with Equans Cyberdefense, ERP teams and service providers to address significant logging or alerting gaps.
• Lead or coordinate the cybersecurity response to ERP incidents, bringing together CSIRT, operations, providers, local IT and business stakeholders.
• Provide security governance over AIO and ServiceNow operational processes, ensuring that security requirements are embedded in incident routing, major-incident management, change management, CAB decisions, evidence retention and the handling and escalation of security-related tickets.
• Ensure that containment, evidence preservation, remediation, communications, lessons learned and crisis-exercise actions are properly coordinated.

Business Continuity, Disaster Recovery & Cyber Recovery Assurance

• Review and independently challenge ERP business continuity, disaster recovery, backup and cyber recovery strategies, plans and recovery objectives.
• Ensure that recovery arrangements are tested at an appropriate frequency, that material gaps and dependencies are addressed, and that actions have clear owners and deadlines.
• Review test outcomes and require formal approval of disaster-recovery and cyber-recovery reports before publication or submission to governance bodies.

Cloud, SAP RISE & Third-Party Security

• Maintain security oversight of ERP cloud services and SAP RISE, ensuring that responsibilities across Equans, providers and local entities are clear and documented.
• Represent Equans in security discussions with ERP outsourcing partners, managed service providers and solution vendors.
• Review and escalate material supplier findings, contractual control gaps and third-party risks, and monitor agreed actions.

Collaboration & Communication

• Build effective relationships with the Global SLS CISO, CISO Office, M-CISOs, SLS ERP leadership, local cybersecurity organisations, ERP teams and strategic partners.
• Communicate complex risks and requirements clearly, providing concise, decision-oriented reporting to technical and non-technical stakeholders.
• Promote ERP-specific security awareness and encourage operational teams to own their controls and remediation activities.

PROFILE

Academic Background & Experience

• Degree or equivalent experience in cybersecurity, information technology, engineering or a related discipline.
• Significant cybersecurity, technology-risk or security-architecture experience in complex international environments, ideally involving SAP and/or Microsoft Dynamics.
• Proven experience of governance, assurance, audits, risk reviews and remediation across internal teams, cloud services and external providers.
• Experience supporting major ERP or cloud transformation programmes in decentralised, multicultural organisations.
• A recognised cybersecurity certification such as CISSP, CISM or CRISC is highly desirable; relevant SAP, Microsoft or cloud-security certification is an advantage.

Knowledge & Technical Understanding

• Strong knowledge of cybersecurity governance, risk management and recognised frameworks, including ISO/IEC 27001, 27002 and 27005.
• Good understanding of ERP security across applications, interfaces, cloud services and supporting infrastructure; SAP and/or Microsoft Dynamics knowledge is highly desirable.
• Understanding of identity and access management, privileged access, segregation of duties, vulnerability management, secure configuration and application security.
• Understanding of cloud and shared-responsibility models, security logging, SIEM, threat detection, incident response, CSIRT and Equans Cyberdefense.
• Knowledge of Microsoft Entra ID, SAP GRC and wider SAP security concepts is an advantage.

Behavioural Capabilities

• Able to combine independent challenge with pragmatic understanding of business, operational and delivery needs.
• Confident in raising concerns, challenging assumptions and escalating unacceptable risks while maintaining constructive relationships.
• Strong analytical, problem-solving and stakeholder-management skills, with the ability to turn technical findings into clear decisions and actions.
• Autonomous, organised and adaptable, with sound judgement, high ethical standards and the ability to prioritise across countries, systems and projects.

Communication & Languages

• Excellent written and verbal communication, including the ability to explain cybersecurity subjects to technical teams, senior management and non-technical stakeholders.
• Fluent professional English is essential; French is an advantage.
• Willingness to undertake occasional international travel.

Why Join Us?

• Global Impact: Be part of a global transformation journey, shaping the future of ERP services across multiple regions
• Career Growth: Future career pathways could include expanding the team to deliver additional services, supporting more MBUs, or taking on responsibility for ERP service delivery across multiple regions, overseeing several hubs and cross-functional teams
• Supportive Culture: Join a team that values innovation, transparency, and continuous learning