10/07/2026 updated
100 % available
OT/IT Cybersecurity Consultant - GRC & Product Security
Villiers sur Marne, France
Only remote
Engineering Degree - CNAM Paris (2021)About me
OT / Industrial Cybersecurity Consultant specialized in IEC 62443, CRA, Secure by Design, risk assessment, threat modelling and OT network security. Experience in industrial automation, transport and critical infrastructure. Open to remote freelance projects across Europe.
Product Cybersecurity & Secure by Design
Expertise in Product Risk Assessment, Secure by Design principles, STRIDE Threat Modeling using Microsoft Threat Modeling Tool, and Security Architecture Reviews. Application of IEC 62443-4-1 (Secure SDLC) and IEC 62443-4-2 (Product Security Requirements) throughout the software development lifecycle.
Governance, Risk & Compliance (GRC)
Deep knowledge of GRC frameworks including IEC 62443, ISO 27001, ISO 27005, EBIOS RM, and NIST CSF. Hands-on experience in risk management, compliance, ISMS implementation, and conducting OT risk analyses on critical infrastructure projects.
Industrial Protocols & OT Security
Proficiency in industrial communication protocols such as IEC 61850 MMS, IEC 61850 GOOSE, EtherCAT, SCADAPack, OPC UA, Modbus TCP, and PROFINET. Experience securing industrial networks through segmentation, hardening, and authentication measures.
Vulnerability Management
Identification, analysis, and tracking of vulnerabilities using tools such as Coverity and Squore. Development of risk mitigation measures including segmentation, hardening, and authentication strategies.
Network Architecture & Segmentation
Review and implementation of industrial network architectures including VLAN, firewall, and DMZ configurations. Mapping of OT assets using Nozomi Networks and securing network exchanges between PLCs and supervision systems.
Security Tools
Practical experience with Microsoft Threat Modeling Tool, Coverity, Squore, Azure DevOps, Nozomi Networks, Fortinet, and Stormshield for cybersecurity analysis, vulnerability management, and project collaboration.
Data Flow Diagrams & Threat Modeling
Modeling of data flows via Data Flow Diagrams (DFD) and performing STRIDE-based Threat Modeling to define security requirements at protocol, software, and system levels.
ISO 27001 Lead Implementer
Certified ISO 27001 Lead Implementer (PECB, since February 2025). Knowledge of information security management including risk assessment, confidentiality, integrity, and availability of data.
Agile & DevSecOps Collaboration
Collaboration with cybersecurity, software development, and validation teams in Agile (Scrum) environments via Azure DevOps. Integration of cybersecurity requirements throughout the Secure Software Development Lifecycle.
Expertise in Product Risk Assessment, Secure by Design principles, STRIDE Threat Modeling using Microsoft Threat Modeling Tool, and Security Architecture Reviews. Application of IEC 62443-4-1 (Secure SDLC) and IEC 62443-4-2 (Product Security Requirements) throughout the software development lifecycle.
Governance, Risk & Compliance (GRC)
Deep knowledge of GRC frameworks including IEC 62443, ISO 27001, ISO 27005, EBIOS RM, and NIST CSF. Hands-on experience in risk management, compliance, ISMS implementation, and conducting OT risk analyses on critical infrastructure projects.
Industrial Protocols & OT Security
Proficiency in industrial communication protocols such as IEC 61850 MMS, IEC 61850 GOOSE, EtherCAT, SCADAPack, OPC UA, Modbus TCP, and PROFINET. Experience securing industrial networks through segmentation, hardening, and authentication measures.
Vulnerability Management
Identification, analysis, and tracking of vulnerabilities using tools such as Coverity and Squore. Development of risk mitigation measures including segmentation, hardening, and authentication strategies.
Network Architecture & Segmentation
Review and implementation of industrial network architectures including VLAN, firewall, and DMZ configurations. Mapping of OT assets using Nozomi Networks and securing network exchanges between PLCs and supervision systems.
Security Tools
Practical experience with Microsoft Threat Modeling Tool, Coverity, Squore, Azure DevOps, Nozomi Networks, Fortinet, and Stormshield for cybersecurity analysis, vulnerability management, and project collaboration.
Data Flow Diagrams & Threat Modeling
Modeling of data flows via Data Flow Diagrams (DFD) and performing STRIDE-based Threat Modeling to define security requirements at protocol, software, and system levels.
ISO 27001 Lead Implementer
Certified ISO 27001 Lead Implementer (PECB, since February 2025). Knowledge of information security management including risk assessment, confidentiality, integrity, and availability of data.
Agile & DevSecOps Collaboration
Collaboration with cybersecurity, software development, and validation teams in Agile (Scrum) environments via Azure DevOps. Integration of cybersecurity requirements throughout the Secure Software Development Lifecycle.
Experience
Professional experience5 - 10 years
Freelancer since2024
Languages
EnglishFluentFrenchNative speakerSpanishBasic knowledge
Project history
Secure by Design implementation project for industrial communication protocol development. Conducted cybersecurity risk analyses on connected industrial products, performed STRIDE-based Threat Modeling, modeled data flows via DFD, defined security requirements at protocol, software and system level, conducted cybersecurity architecture reviews, integrated cybersecurity requirements throughout the Secure SDLC, collaborated with development and validation teams in an Agile (Scrum) environment via Azure DevOps, analyzed industrial protocols (IEC 61850 MMS, IEC 61850 GOOSE, EtherCAT, SCADAPack), analyzed Build Time and Run Time threats, managed vulnerabilities using Coverity and Squore, developed risk mitigation measures, and wrote technical deliverables in English.
Grand Paris Express - Line 15 project. Deployed IEC 62443 requirements on a critical infrastructure project, conducted OT risk analyses following EBIOS RM methodology, reviewed industrial network architecture, implemented network segmentation (VLAN, firewall, DMZ), mapped OT assets using Nozomi Networks, analyzed vulnerabilities and tracked remediation plans, validated cybersecurity during FAT, SAT and on-site testing, secured OPC UA and Modbus TCP exchanges and industrial networks, commissioned Schneider M580 PLCs, and collaborated with automation, SCADA and network teams.
Contributed to integrating cybersecurity requirements into connected industrial architectures, applied IEC 62443 principles during system design and commissioning, conducted risk analyses and identified critical assets on industrial projects, took part in architecture reviews of automation systems and industrial networks, contributed to Industry 4.0 projects involving data collection and secure exchanges between PLCs and supervision systems, and contributed to continuous improvement of the ISMS and alignment with ISO 27001 requirements.
Certificates
ISO 27001 Lead Implementer
PECB2025