Business application audit consultant

Context and Objectives: The mission aims to assess and secure the business applications of the information system, to manage risks, and to improve their governance, architecture, operation, and compliance. – Identify risks, vulnerabilities, and compliance gaps; – Evaluate the effectiveness of controls, processes, and service level agreements; – Formulate prioritized and measurable operational recommendations.Main responsibilities: The consultant conducts audits of applications in development or production, particularly during a redesign, major upgrade, security review, intrusion risk assessment, or regulatory change. Their work covers governance, processes, functionalities, data, flows, interfaces, architecture, access rights, security, development, and testing.Activities and expected deliverables • Define the scope of the mission, analyze the documentation and develop the work program; • Conduct interviews, investigations, checks and tests on documents or on site; • Evaluate the risks and the quality of the controls, then formalize substantiated findings; • Facilitate feedback sessions and ensure follow-up on recommendations.Expected deliverables : • Scoping note and audit plan; • Risk and control matrix, application mapping and evidence file; • Register of findings and reporting support; • Provisional and final reports, action plan and monitoring table.Required skills • Proficiency in IT audit methodologies, risk analysis, and control assessment; • Expertise in application architectures, APIs, data flows, databases, cloud computing, access rights management, application security, and secure development practices; • Ability to review code, configurations, logs, and test results, qualify vulnerabilities, and rule out false positives; • Proficiency with audit and security tools, including Burp Suite, OWASP ZAP, Postman, Nessus, Qualys, OpenVAS, SonarQube, Checkmarx, Fortify, Snyk, Nmap, Wireshark, Microsoft Sentinel, Splunk, or equivalent; • Excellent analytical, writing, presentation, and facilitation skills, with rigor, autonomy, diplomacy, and respect for confidentiality.Required frameworks and standards • ISO/IEC 27001, 27002 and 27005, ISO 19011 and ISO 9001; • EBIOS Risk Manager, COBIT and ITIL; • OWASP Top 10 and ASVS, CIS Controls and Benchmarks, NIST Cybersecurity Framework and ANSSI recommendations; • GDPR and CNIL requirements.Selection criteria • Experience: at least five years in application auditing of critical or complex business applications, with comparable references; • Expertise: complete mastery of the audit cycle, risks, application security, tools and required frameworks; • Quality of intervention: structured method, reasoned findings, pragmatic recommendations and actionable deliverables; • Soft skills: autonomy, listening skills, teaching ability, respect for deadlines and ability to work with business, technical and managerial stakeholders.Desired profile: Experienced consultant with at least five years of effective experience in application auditing. They must have conducted end-to-end missions — scoping, document analysis, interviews, testing, risk assessment and controls, reporting and follow-up — on applications in project or production, in collaboration with business, development, production, security and IT governance teams.Application: CV + cover letter + copies of diplomas to be sent to
#J-18808-Ljbffr