Risk and Business Continuity Analyst

JOB TITLE: RISK AND BUSINESS CONTINUITY ANALYST

LOCATION: NAMUR, BELGIUM

DURATION: 03/11/2026 - 14/06/2027 PLUS POSSIBLE OF EXTENSION

LANGUAGES: FRENCH AND ENGLISH

WORK REGIME: 100% (FULL-TIME AND HYBRID 2(OR)3 DAYS ONSITE)

JOB DESCRIPTION

• Main mission Assess, prioritise and trace the cyber risks related to industrial systems and their IT dependencies present on the public infrastructures managed by the SPW MI (tunnels, dams, locks, remote management, road equipment, optical fibres, etc.) and recommend the appropriate treatment measures.

DOMAIN

PRIORITY ACTIONS

MAPPING & INVENTORY:

• Identify OT assets (PLC, RTU, HMI, field networks) and their IT dependencies in the unified CMDB.
• Identify SPOFs: Domain Controller, inter-network links, critical markets, firewalls, etc.

OPERATIONAL RISK ANALYSIS

• Apply the SPW methodology to model threats (tunnel stop, dam overflow, etc.), vulnerabilities and impacts (personal safety, environment, availability, finances, image, etc.)
• Use concrete scenarios based on the SPW's 2025 crisis feedback.

TREATMENT PLAN & PRIORITIZATION

• Develop the implementation plan for actions to address the risks analysed (reduction, avoidance, transfer, acceptance).
• Quantify the cost/impact and develop a risk reduction roadmap aligned with the continuity of the systems' operations
• Communicate the full risk management cycle.

PROJECT & MARKET INTEGRATION

• Write IT/OT security clauses in specifications
• Verify the compliance of critical OT suppliers (PLC maintenance, supervision).

SYNERGIE IT/OT & SOC

• Translate OT risks into logging requirements and detection rules for the SPW SOC (use-case, PLC takeovers, ...).

RESILIENCE & EXERCISES

• Participate in restoration tests and OT/IT table-top exercises to validate impact hypotheses.
• Contribute to feedback and analyze root causes
• Contribute to the continuous improvement of Business Continuity Plans (BCPs) and Disaster Recovery Plans (DRPs).

REPORTING & GOVERNANCE

• Maintain the OT risk register, prepare summaries for the Cyber MI Committee and for NIS2 audits (risk management policy).

EXAMPLES OF DELIVERABLES

• Business continuity plan and disaster recovery plan
• Detailed inventory of OT assets and IT dependencies (CMDB).
• OT risk register with scoring, scenarios, owners and deadlines.
• Mapping of areas and conduits + flow diagrams.
• Prioritized treatment plan (24-month roadmap).
• Security requirements grids for OT purchases/modernizations.
• Quarterly reports to the Coordinator: risk status, progress, decisions to be arbitrated.

EXPECTED BEHAVIOURAL SKILLS

• Assertiveness and ability to be a force of proposal
• You are autonomous but you appreciate teamwork
• Very good communicator, customer and results oriented
• Positive and caring attitude, active listening
• Teaching capacity and popularization of technical aspects
• Rigorous and methodical

SKILLS

• Communication & influence (popularization for managers and field teams)
• Knowledge of industrial communication protocols such as Modbus, PROFINET, DNP3 or equivalent.(mandatory)
• Knowledge of I&C systems such as SCADA, PLC, RTU, DCS or equivalent.(mandatory)
• Cybersecurity Framework (NIST, Cyberfundamentals)(mandatory)
• Risk management methodologies (ISO 27005, IEC 62443-3-2, EBIOS RM)(mandatory)
• Information Security Standards and Frameworks (IEC 62443)(mandatory)
• CRM & Reporting Tools(mandatory)

QUESTIONS:

• Do you have a risk management certification? If so, please include it with your application
• Have you ever conducted an OT risk analysis on industrial systems? If so, what method did you use and why?
• Have you ever had to arbitrate between security and operational readiness in your recommendations? If so, how did you present your conclusions to the business lines?
• Have you ever included suppliers in a risk analysis? If so, how did you assess their level of security and document the results?
• Have you already formalized a risk register read by technical and non-technical parties? If so, what compensatory measures have you proposed or put in place?