2022M102_P-089 – Risk and Business Continuity Analyst

7 months
03/11/2026 - 14/06/2027
Namur, Belgium

Main mission

Assess, prioritize, and track cyber risks related to industrial systems and their IT dependencies present on public infrastructures managed by SPW MI (tunnels, dams, locks, remote management, road equipment, optical fibers, ...) and recommend appropriate mitigation measures.

Key activities

Domain
Priority actions

Mapping & Inventory

• List OT assets (PLC, RTU, HMI, field networks) and their IT dependencies in the unified CMDB.
• Identify SPOFs: Domain Controller, inter-network connections, critical markets, firewalls…

Operational Risk Analysis

• Apply the SPW methodology to model threats (tunnel shutdown, dam overflow, ...), vulnerabilities, and impacts (people's safety, environment, availability, finances, image, ...)
• Use concrete scenarios based on SPW’s 2025 crisis experience feedback.

Treatment Plan & Prioritization

• Develop an implementation plan for actions to address the analyzed risks (reduction, avoidance, transfer, acceptance).
• Estimate the cost/impact and develop a risk reduction roadmap aligned with the continuity of system operations
• Communicate the complete risk management cycle.

Project & Procurement Integration

• Draft IT/OT security clauses in the specifications
• Verify compliance of critical OT suppliers (PLC maintenance, supervision).

IT/OT & SOC Synergy

• Translate OT risks into logging requirements and detection rules for the SPW SOC (use cases, PLC takeover, ...).

Resilience & Exercises

• Participate in restoration tests and OT/IT table-top exercises to validate impact hypotheses.
• Contribute to experience feedback and analyze root causes
• Contribute to the continuous improvement of business continuity plans (BCP) and disaster recovery plans (DRP).

Reporting & Governance

• Keep the OT risk register up to date, prepare summaries for the Cyber MI Committee and for NIS2 audits (risk management policy).

Example deliverables

• Business continuity plan and disaster recovery plan
• Detailed inventory of OT assets & IT dependencies (CMDB)
• OT risk register with scoring, scenarios, owners, and deadlines
• Mapping of zones & conduits + flow diagrams
• Prioritized treatment plan (24-month roadmap)
• Security requirement matrices for OT procurement/modernization
• Quarterly reports to the Coordinator: risk status, progress, decisions to arbitrate

Expected behavioral skills

• Assertiveness and ability to be a driving force
• You are autonomous but enjoy working in a team
• Very good communicator, client and results-oriented
• Positive and supportive attitude, active listening
• Ability to educate and simplify technical aspects
• Rigorous and methodical

Mission: extendable until 30/11/2027