Chief Information Security Officer

The ESRF is a world-class research facility that produces extremely intense X-ray beams to enable scientists to explore matter at the nanoscale. Information Technology systems and services are essential to the successful operation of all ESRF Divisions. Ensuring that the ESRF's digital infrastructure, scientific computing environment, and software solutions are effectively protected against cyber threats is therefore of critical importance.

The ESRF's infrastructure, the software solutions and services are developed and operated by several IT teams across the Experiments Division, the Instrumentation Services and Development Division, and the Technical Infrastructure Division, but also the Accelerator and Source Division and the Administration Division.

As Chief Information Security Officer (CISO), you will define and drive the ESRF's cybersecurity strategy while fostering a strong security culture across the organisation. Although the role has no direct line management responsibility over the IT teams, you will provide strategic leadership, coordinate cybersecurity initiatives across divisions, and build consensus among multiple stakeholders.

Key Responsibilities

• Develop, maintain, and continuously improve the ESRF's cybersecurity policies, standards, and governance framework.
• Define the cybersecurity roadmap, establish priorities, and oversee the implementation of strategic action plans.
• Coordinate cybersecurity activities across all ESRF divisions to ensure a consistent and effective security posture.
• Maintain the organization's cybersecurity risk assessment process, identify emerging risks, and initiate internal or external security audits where appropriate.
• Oversee the implementation of security controls by the IT teams and ensure compliance with cybersecurity policies and best practices.
• Monitor vulnerability alerts, coordinate vulnerability management activities, and validate remediation actions.
• Keep IT teams informed of emerging cyber threats, vulnerabilities, and appropriate mitigation strategies.
• Design, launch, and coordinate cybersecurity awareness and training programmes for ESRF staff.
• Define cybersecurity Key Performance Indicators (KPIs), monitor security metrics, and regularly report on cybersecurity risks and performance to senior management.