CISO O+O (Online + Offline)

Hello, we’re L’Oréal. We're not just building brands, we're shaping how the world experiences beauty (and it takes a lot of cool jobs to do it). Intrigued? Keep reading, this might be the opportunity you've been searching for.

A Day in the Life

This position is part of L’Oréal Group Cybersecurity Team. O+O (Online + Offline) refers to the strategic integration of digital and physical touchpoints into a single ecosystem, to provide a unified and seamless experience across every consumer & customer interaction.

Your future team is organized around 3 key pillars:

• Online: E-commerce, Website Factory, Consumer Engagement… This department powers up L’Oréal Digital Footprint jointly with Digital and Marketing Business Teams.
• Omnisales: Retail, Services, Commercial… Omnisales mission is to turn L’Oréal Points of Sales into Points for Experience, and to augment all commercial Teams in Markets Worldwide.
• Omniinnovation: Station F, Gen AI, Retail Lab… This Team accompanies innovative and creative initiatives to scout the most promising ones, which could be scaled at L’Oréal.

The Team works in very close collaboration with the Divisions and Zones, as well as with other L’Oréal functions such as Marketing, Finance, and more.

Reporting to the Business Platforms CISO, you will be responsible for all aspects of Information security and technology Risk Management for O+O scope, including a major Cybersecurity transformation program with a worldwide impact (Titanium). It is a Leadership role that requires a strong technical background, as well as excellent communication skills to work jointly with Business and IT Teams in order to ensure compliance to L’Oréal Information Security Policy and applicable laws and regulations, while enabling and facilitating the Business.

Your responsibilities:

• Manage O+O Cybersecurity Team, composed of both internal and external Departments Cybersecurity Managers.
• Define and enforce an information security strategy for IT O+O scope.
• Maintain close relationships with zones animating O+O Cybersecurity Community worldwide.
• Jointly with the Business and IT Teams, ensure L’Oréal Integration of Security in Projects methodology is properly applied.
• Follow-up on Third Party Cybersecurity Risk Management: in particular, work closely with legal and purchasing teams to ensure appropriate integration of security requirements at the earliest stages of Third Parties Selection and contracting.
• Proactively identify and mitigate information security risks throughout the lifecycle of O+O assets.
• Manage security exceptions and formally document risk acceptance and associated compensatory measures.
• Lead and drive Titanium O+O Cybersecurity program jointly with infrastructure and IT O+O Teams, both at global and zone level.
• Manage regulatory compliance jointly with the concerned teams (Data Privacy, etc.).
• Follow-up on compliance and security KPIs and put in place appropriate action plans to continuously improve these KPIs.
• Follow-up on Threat and Vulnerability Management process and related remediation plans.
• Ensure prompt and close follow-up of security incidents, jointly with L’Oréal CSIRT.
• Act as a Cybersecurity evangelist, designing and leading engaging awareness sessions for diverse audiences.
• As part of L’Oréal Global Cybersecurity Team, you will actively contribute to securely Create the Beauty that Moves the world.

We Are Looking For

First and foremost, we love people that are curious, collaborative, eager to have an impact, proactive and who value innovation, autonomy, and team spirit.

We are looking for someone [highly experienced] [with at least 10 years of experience] in information security in similar roles.

Your core skills:

• Strong technical background in IT security.
• Good knowledge of Cybersecurity Strategy definition and implementation.
• Excellent interpersonal skills.
• Good knowledge of Risk Management standards.
• Good knowledge of domain-specific and security-related regulations and standards such as GDPR and PCI-DSS.
• Excellent spoken/written French & English (international context).
• Rigorous and organized mindset.
• Team Management Experience (particularly Transversal Team Management).
• Important: You hold Cybersecurity certifications such as CISSP.

What’s In It For You

• A place for you to leave your comfort zone and grow beyond your potential (here, you’ll be encouraged to try new things and take risks!)
• Real responsibility from day 1, there’s no sitting on the sidelines at L’Oréal
• An environment where people of every ethnicity, social background, age, religion, gender and sexual orientation as well as people with disabilities are accepted, can speak up, will thrive and are celebrated!
• A place where you can contribute to something bigger! Many of our brands have societal /environmental causes to make concrete difference
• A flexible hybrid work model: a minimum of 3 days per week at our SO Tech office in Saint-Ouen, and up to 2 days of remote work

Who We Are

L’Oréal is present in 150 markets on five continents. For more than a century, L’Oréal has devoted itself solely to ‘Create beauty that moves the world’; it is now the industry world leader with €42 billion consolidated sales. Together, we solve complex challenges at scale, while making sure we stay committed to making the world a more inclusive and a better place for everyone & our planet.

Today, L’Oréal includes over 9k experts in beauty tech, digital, data and e-comm and is constantly growing. Championing Beauty Tech, we invent the beauty of the future while becoming the company of the future. To achieve this ambition, L’Oréal continues to recruit diverse, innovative, skilled, and passionate minds in different tech domains such as Data, Digital, Cloud, Cyber Security, IT Architecture, DevOps, Applications, and Infrastructure.

We’re committed to guaranteeing inclusive recruitment processes and to advocating for hiring and promoting each candidate in an ethical and equitable way. The Group strictly prohibits discrimination against any applicant for employment because of the individual’s gender identity or expression, sexual orientation, visible and/or invisible disabilities, socio-economic and/or multicultural origins, health conditions, age, religion, or any other characteristics protected by law.