GRC Director

About Sonepar

Sonepar is an independent family-owned company standing as the world leader in B-to-B distribution of electrical equipment, solutions, and services. In 2024, Sonepar achieved sales of €32.5 billion. Present in 40 countries with a dense network of brands, the Group is leading an ambitious transformation to make its customers’ lives easier providing them with an omnichannel experience and sustainable solutions in the building, industry, and energy markets. 

Sonepar’s 46 000 associates are committed to accelerating the world’s electrification and driven by a shared Purpose: Powering Progress for Future Generations.

www.sonepar.com

 

How will you shape our tomorrow

We are seeking a strategic and visionary leader to join our organization as the director of Governance, Risks, and Compliance (GRC). You will report directly to the Senior Vice President Cybersecurity & Infrastructure. You will act as the global lead and subject matter expert for Governance, Risks, and Compliance strategy and monitor the whole GRC policy for the group. You will act as an expert in GRC strategies, creating and managing a global team of GRC Specialists, contributing to the identification, development, implementation, maintenance and oversight of information security policies, procedures, and processes across the organization in order to reduce risks, minimize incidents impacts, and limit exposure to liability in all areas of financial, physical and personal risks.

You will lead the definition and the implementation of the corporate information security strategy aligned with the Group strategic vision and plan.

 

You will manage a team of experts responsible for the 3 following topics: 

1. Governance

• • Define the policies, procedures, standards and processes to implement the security strategy across the organization and entities of the Group and ensure ongoing maintenance and audit of information security; 
  • Define a security control framework and audit requirements to monitor the effectiveness of the security policies, procedures and management framework,
  • Define the framework to assess third party risk management (TPRM) and coordinate the execution;
  • Provide safeguard recommendations and assist the Group's Business and support functions with the implementation of these recommendations stemming from security risk assessments;
  • Ensure that the operational recommendations are followed by the risk owners, in collaboration with the Enterprise Risk Management group, but also assist in planning and sponsor the security awareness program to support continuous training on security related topics.

1. Risks 

• • Conduct information security risk assessments, based on a framework which specify how to define, identify and classify critical assets, assess threats and vulnerabilities regarding those assets across the organization, in order to ensure that key risk issues are understood, communicated, and tracked on appropriate risk registers.
  • Promote and facilitate cybersecurity feedback and post-mortem analysis, which allow to identify gaps and generate continuous improvement;
  • Define information security key performance indicators that will ultimately be reported to executive management through dashboards crafted with those purpose;
  • Perform a continuous improvement approach to industrialize the capture of risk information for consolidation, centralization and decision-making process, streamlined across the organization.

1. Compliance: 

• • Coordinate security related processes and ensure compliance toward regulatory frameworks such as NIST CSF, NIST 800-171, ISO 27001, encompassing physical protection, premises access, asset protection and digital security;
  • Provide support and collaborative effort to Privacy-related compliance regulations (i.e. GDPR, Data Sovereignty Act, PIPEDA, CCPA, etc…);
  • Optimize continuously the process allowing to track, follow-up and remediate the audit findings from the various audit reports;
  • Represent Information Security within working groups for various projects or initiatives to ensure that information security requirements and frameworks are communicated and respected. 

The experience you bring

• Education: You hold some of these certifications: ISO27001 Auditor, CISSP, CISM, CISA, CRISC, or CGEIT 

• Knowledge & Experience
  • Experience in using frameworks like NIST CSF, NIST 800-53, ISO 27002 and IS