IT and CyberSecurity Auditor – Ethical Hacking

Responsibilities

Société Generale (“SG”) is a top-tier global European bank, headquartered in France, with 120,000 employees serving some 26 million clients in more than 62 countries around the world. We have been supporting the development of our economies for more than 160 years by providing our corporate, institutional and individual clients with a broad array of value-added financial solutions and advisory services.

Our longstanding relationships of trust with clients, our cutting-edge expertise, our unique ability to innovate, our ESG capabilities and our leading franchises are part of our DNA and serve our core objective: to create sustainable value for all our stakeholders.

The Group operates in three complementary business areas, incorporating ESG offers for all its clients:

• Global Banking and Investor Solutions, the Wholesale Banking arm of SG, is a top-tier player providing large corporates and investors with tailormade solutions with unique global leadership in equity derivatives, structured finance and ESG;
• French Retail Banking, Private Banking & Insurance, comprises the core of retail banking, private banking, insurance activities, and the leading online banking activities;
• Mobility, International Retail Banking & Financial Services includes universal banks that are well-established on their local markets, Ayvens, a global player in sustainable mobility, as well as specialized financing activities.

In the Americas specifically, SG consists of U.S. and Canadian subsidiaries, branches and representative offices, as well as branches, subsidiaries and representative offices in Brazil, Chile, Mexico and other countries in Latin America relating to the Wholesale Banking Division of SG (collectively, “SG Americas”).

The SG Internal Group Audit Division (IGAD) represents SG’s independent internal audit function, comprised of over 1,200 professionals covering SG's global business and services in over 150 countries. Moreover, we have a dedicated team of about 60 professionals to cover SG Americas, SG Internal Audit Americas (“SGIAA”). The team is composed of individuals with diverse backgrounds and subject matter expertise based in the New York, Sao Paulo, and the newly formed team in Montreal.

SGIAA conducts independent audits of operational entities in an objective, thorough and impartial manner in line with professional standards. In addition, SGIAA assesses the compliance of the Group's operations, the effective level of risk exposure and management, the adequate enforcement of procedures and the effectiveness and relevance of the permanent control set-up.

1. ROLE & RESPONSIBILITIES

The IT and Cyber Security Auditor Associate will be part of the Internal Audit IT Team primarily covering Cyber Ssecurity testing, as well as Information Technology systems, and Data Management functions. The Associate is expected to have a high degree of independence and autonomy and participates to all stages of the audit process, under the supervision of the head of assignment.

The candidate’s primary responsibilities will be to assist in:

• Participate to all types of regional or global IT audits, as part of either dedicated audits of IT functions or as part of integrated audit conducted in conjunction with the business/financial auditors.
• Independently and autonomously participate in the audit process: create diagnostic matrix with proposed processes and controls for review, identify use cases for data quality testing and relevant sampling strategies, provide concise and comprehensive debriefing presentation for IGAD management and auditees.
• Added hands-on responsibilities covering: Network and host security testing; Web application and API testing; Active Directory and cloud identity attack-path analysis; Azure, AWS, Kubernetes and CI/CD security; Vulnerability validation and controlled exploitation; Threat-led testing and detection-control validation; Scripting, automation and reusable technical audit procedures. [With explicit authorization]
• Ensure that Audit management is informed, on a timely basis, of all significant issues arising from missions and of any event that may have an impact on the company.
• Write clear and impactful findings and audit reports that provide added value to the organization.
• Perform diligent follow-up of audit recommendations and action plans.
• Contribute to the development of risk assessment, internal control evaluations, and other processes necessary to determine areas of risk or weakness that will contribute to the development of audit plan and strategy.
• Participating in department wide transformation projects (data analytics, digital transformation, etc) and actively contribute, communicate and implement the changes, and support others through the process.

Profile required

Required Skills and Qualifications:

• Bachelor's degree in Computer Science, Information Systems, Information Technology or a business discipline.
• Candidate should have at least 3 years of information systems experience, preferably within banking/financial institutions.
  • Proficiency in security assessment tools and methodologies (e.g., vulnerability scanners, penetration testing).
  • Practical understanding of network security, application security, and data protection.
  • Familiarity with IS/IT processes (incident management, change management, release management, configuration management, etc.)
  • Working knowledge of IT Security concepts, familiarity with vulnerability testing and awareness of security exploits
  • Working knowledge of enterprise technology environments, including Windows and Linux/UNIX operating systems; databases such as SQL Server, Oracle and DB2; network infrastructure and security technologies, including firewalls, routers and switches; identity and access management; virtualization and cloud platforms(Microsoft Azure, AWS); and web applications and APIs.
  • Familiarity with recognized cybersecurity and IT control frameworks and assessment guidance, such as NIST Cybersecurity Framework, ISO/IEC 27001 and 27002, COBIT, CIS Controls and FFIEC guidance, complemented by an understanding of OWASP testing guidance for web applications and APIs.
• Plus
  • Familiarity with investment banking/financial services business and products
  • Relevant Cyber Security Certifications (OSCP, GPEN, CISSP etc.)
  • Familiarity with scripting languages such as Python, PowerShell or Bash to support security testing, data analysis and audit automation.

LANGUAGE:
Ability to communicate in English, both orally and in writing, is a requirement as the person in this position will need to collaborate regularly with colleagues and partners in the United States.

DISCLOSURE:
Due to US Federal Securities law that may apply to this position, candidates who will apply for this position may be required to submit to an enhanced background screening, including the collection of their fingerprints by a third-party vendor selected by the Financial Industry Regulatory Authority ("FINRA").

Business insight

Societe Generale is committed to offering an inclusive recruitment experience to all candidates. If you require any reasonable accommodations during the recruitment process, please do not hesitate to let our Recruiters know.

OUR CULTURE:
At Societe Generale, we live by our 4 core values of commitment, responsibility, team spirit and innovation. We are engaged and demonstrate consideration for others. We act ethically and with courage. We focus our talent and energy on collective success. We experiment and propose new ideas. This way, we maximize our ability to serve client needs and anticipate market changes. Societe Generale is committed to strengthening bonds with colleagues, communities, and the world in which we live, because relationships are at the heart of how we operate. For more information about our Culture and Conduct initiatives, please visit this link (https://americas.societegenerale.com/en/careers/get-know-culture/)

OUR DIVERSITY & INCLUSION MISSION:
Recruit, develop, advance, and retain a diverse workforce that is united in our efforts to enhance our competitive position and deliver innovative solutions to our clients; foster an engaged workforce that reflects the communities in which we operate; create an inclusive culture and workplace that recognizes employees' unique needs and utilizes their diverse talents; and strong engagement in our community and marketplace to meet the needs of all our clients. Learn More: https://americas.societegenerale.com/en/careers/get-know-diversity/

USE OF AI GUIDELINES FOR CANDIDATES:
Société Générale permits responsible use of artificial intelligence (AI) in recruitment. Information provided by candidates must authentically reflect their own skills and experience. AI must not be used for real-time interview coaching, to complete assessments, or to generate responses during interviews. Misuse may undermine the integrity of the process and result in exclusion. This restriction does not apply to assistive technologies used for accessibility or disability-related purposes.

Diversity and Inclusion

Societe Generale is an equal opportunity employer and we are proud to make diversity a strength for our company. We are committed to recognizing and promoting the talents and achievements of our employees and staff, regardless of race, religion, color, national origin, sex, disability, age, gender, sexual orientation, and any other characteristic or status protected under applicable law.
We strive to write our postings as inclusively as possible. If, however, one gender is used alone in this display, it designates persons of all gender identities.