Senior Analyst, Information Security Management

ROLE DESCRIPTION SUMMARY

SES operates critical infrastructure across a multi-orbit satellite network serving broadcasters, telecom operators, airlines, shipping lines, enterprises and governments worldwide. We are looking for a GRC professional to help keep that infrastructure secure, certified and ahead of a fast-changing regulatory landscape. You will join a global Information Security Management team and work with engineering, operations, IT, legal and procurement colleagues across Europe, the Americas and beyond. This is a senior individual-contributor role: you own workstreams end to end and act as a trusted adviser to the business.

It is one of the widest playgrounds a security professional can find: decades-old ground-segment systems alongside next-generation programmes such as meoSphere and EU sovereign connectivity initiatives, in a sector that is becoming regulated critical infrastructure in real time. The frameworks match the stakes: ISO 27001, SOC 2, PCI DSS, NIS2 and the upcoming EU Space Act, which is still being written, and which SES has to be ready for before it applies. The work is not only maintaining what exists. New obligations have to be translated into controls, new programmes need security governance built in from the start, and the evidence has to hold up in front of auditors, customers and governments. You will not be asked to master all of it on day one. You will be asked to grow into it.

PRIMARY RESPONSIBILITIES 

- Own information security risk assessments across business units, systems and projects, and turn findings into treatment plans that risk owners act on.
- Keep SES certified and audit-ready (ISO 27001, SOC 2, PCI DSS, NIS2), from scoping and evidence collection to auditor liaison and remediation.
- Help maintain and improve the ISO 27001-based ISMS and the unified control framework mapping ISO 27001, NIST SP 800-53, NIS2, SOC 2 and PCI DSS.
- Track new and changing space-sector regulation and translate it into requirements SES can implement.
- Embed security governance in major programmes, defining requirements and checking they are met at key milestones.
- Assess third-party and supply-chain security risk and support customer and government security questionnaires.
- Shape security awareness across SES and report risk and compliance metrics to ISM leadership and the CISO.

COMPETENCIES

- Information Security Management: Applies governance, risk and compliance principles to protect information assets and ensure regulatory and certification requirements are met.
- Risk Assessment and Treatment: Identifies, evaluates and mitigates information security risks across diverse environments.
- Regulatory and Audit Compliance: Maintains audit readiness through documentation and evidence support across internal and external assessments.
- Communication and Collaboration: Builds constructive relationships and communicates effectively across interdisciplinary, global teams.
- Continuous Improvement: Promotes enhancement of security processes, policies, and controls in line with changing threats and business needs.

QUALIFICATIONS & EXPERIENCE

- Six or more years in information security, with hands-on experience implementing or maintaining an ISO 27001 ISMS.
- Solid grounding in security risk management (ISO 27005 or equivalent) and in mapping controls across frameworks.
- Enough technical depth to read findings, challenge engineers, and judge whether a cloud or network control actually works.
- Clear, constructive communication with stakeholders from system owners to senior management.
- Degree in a relevant field or equivalent experience.
- Nice to have: a relevant certification (ISO 27001 LI/LA, CISM, CRISC, CISSP); exposure to NIS2, SOC 2 or PCI DSS; experience with GRC platforms; a background in space, telecom, aerospace or defence.

OTHER KEY REQUIREMENTS / COMMENTS

- Based in Bucharest, 3 days per week on site.

- NATO nationality required; EU nationality a plus.