CFrFractionalOFind a firm

Paris · Chief Information Security Officer

Fractional CISO in Paris

The second most-established fractional role after CFO, and for the same reason: the need is compliance-triggered and finite. An enterprise customer conditions a contract on ISO 27001, a regulator names a required officer, an insurer asks for MFA and offline backup attestations before renewal — and a company of eighty people discovers it needs security judgment it cannot justify hiring full-time.

Employer contributions are largely uncapped above the plafond, so on-costs scale with executive pay rather than flattening out — the opposite of Thailand, where they are effectively nil at CFO level.

Find a CISO in Paris

What they deliver

  • Security programme and a costed 12–18 month roadmap
  • ISO 27001 or SOC 2 readiness, through to managing the external auditor
  • Incident response plan mapped to each regulator’s notification clock, and the tabletop exercises to test it
  • Enterprise customer security questionnaires — often the highest-return work on the whole mandate
  • Third-party and vendor risk: tiering, diligence, contract security schedules
  • Board and regulator reporting, and managing the MSSP or a small internal team

Signals you need one

  • A customer has made ISO 27001 or a security questionnaire a condition of the contract
  • You have had a breach, a ransomware scare, or a near-miss nobody formally closed out
  • Cyber insurance renewal came back loaded, or declined
  • A buyer or investor has commissioned technical due diligence
  • Security has been the CTO’s side job and headcount is now past fifty
  • You have security engineers but nobody senior enough to set the direction
Two markets where this does not work

Saudi Arabia and South Korea both require the named security officer to be an internal, full-time appointment — Saudi under NCA Essential Cybersecurity Controls 1-2-2, which requires cybersecurity roles to be filled by full-time Saudi nationals, and Korea under the Network Act, where the CISO is designated and reported to the Ministry of Science and ICT, with larger companies barred from letting that person hold unrelated duties. In both, a fractional CISO can advise the designated officer but cannot be them. Hong Kong is the opposite case: its critical infrastructure regime expressly allows the security management unit and its supervisor to sit outside Hong Kong, which makes it the most fractional-friendly regime in the region.

The Paris numbers

Fractional, per monthEUR 5,000–12,000 a month (USD 5,800–14,000), typically EUR 7,000–9,200 at two days a week for an expert-level DAF, with Île-de-France carrying a 10–15% premium over the rest of the country. Day rates run EUR 600–1,000 for a DAF à temps partagé. Management de transition is a different product at a different price: EUR 900–1,200 a day for a confirmed profile, EUR 1,200–1,500 senior, and EUR 1,600–1,800 in the top quartile — a six-month full-time mandate lands at EUR 110,000–200,000. Advisory-only, a board pack and a monthly call, runs EUR 1,800–3,500.
Full-time, all-inBase EUR 110,000–180,000 for a Paris DAF in a mid-market company; Île-de-France pays 10–20% above the rest of France. All-in with employer contributions, bonus, mutuelle, prévoyance and a car, EUR 175,000–290,000 a year — roughly USD 205,000–340,000. A group DAF with fifteen years behind them reaches EUR 300,000 base alone.
Employer on-costsRoughly 40–45% of gross at cadre level, and largely uncapped. Maladie 13% plus 0.3% CSA, allocations familiales 5.25%, vieillesse déplafonnée 2.11%, chômage 4.05%, AGS 0.25%, FNAL 0.5%, and AT/MP by sector. Above the monthly plafond of EUR 4,005 the retirement layer takes over: AGIRC-ARRCO tranche 2 at 12.95% employer, CEG at 1.62%, CET at 0.21%. Only vieillesse plafonnée at 8.55% actually stops at the ceiling.
SeveranceIndemnité légale de licenciement, art. R1234-2: one quarter of a month per year for the first ten years, one third thereafter — modest on its own. The real exposure is elsewhere. A rupture conventionnelle carries a 30% employer contribution on the exempt portion since 1 September 2023, and the negotiated figure for a DAF is customarily several times the legal minimum. If it goes to the conseil de prud’hommes instead, the barème Macron (art. L1235-3) runs from one month at under a year of service to twenty months at thirty years — and does not apply at all where the dismissal is null, which uncaps it.
Work permitsEU, EEA and Swiss nationals work freely. Everyone else needs an authorisation, usually a passeport talent for an executive. In practice the fractional structure sidesteps payroll entirely: a company-to-company prestation de services, invoiced from the provider’s own entity. Two things to watch. A non-EU provider triggers the TVA reverse charge, which costs nothing but must be declared. And an executive habitually present in France with authority to conclude contracts can create an établissement stable for the foreign provider — which is a tax problem for the provider, not the client, but it shapes how the mandate is written.

The full Paris picture — tax, regulation and market context →

What governs this in France

Prêt de main-d’œuvre illicite (C. trav. L8241-1)

The one that catches foreign buyers. Any for-profit operation whose exclusive object is lending labour is criminal — two years and EUR 30,000 for an individual, EUR 150,000 for a company under L8243-1, plus the délit de marchandage at L8231-1. A fractional mandate stays lawful only if it buys a defined outcome delivered with the provider’s own expertise and under the provider’s own supervision. Buy a warm body who takes instructions from your management and sits in your org chart, and you have bought a criminal offence and a contrat de travail.

Entreprise de travail à temps partagé (C. trav. L1252-1)

France legislated for this in 2005 and almost nobody outside France knows it exists. An ETTP employs the executive on a CDI and places them with companies that cannot recruit the profile directly because of their size or means. Unlike intérim there is no closed list of permitted reasons — punctual, recurring or durable needs all qualify. It is the cleanest structure in Europe for shared senior leadership, and it sits alongside the groupement d’employeurs, where several SMEs jointly employ one person.

Portage salarial (C. trav. L1254-1, CCN IDCC 3219)

The default vehicle for an independent French executive. A portage company employs the consultant, invoices your business, and runs the payroll; the consultant must earn at least 75% of the monthly plafond, and management fees run about 5–10% of billings. It converts an independent into an employee of someone else, which removes your requalification risk — and it is why a French day rate looks high next to an Asian one. Roughly half of it is social contributions.

Commissaire aux comptes thresholds (décret 2024-152)

A statutory auditor becomes compulsory on two of three: EUR 10m revenue, EUR 5m balance sheet, 50 employees. For a company controlled by a group that already needs one, the thresholds drop to EUR 5m, EUR 2.5m and 25 employees — which catches the French subsidiary of a foreign group far earlier than its owners expect, and is one of the most common reasons a French entity suddenly needs a real finance function.

Other roles in Paris

Fractional CFOFractional COOFractional CTOFractional CMOFractional CROFractional CHRO

Find a CISO in Paris

Sharing your details

We will provide the details you submit — name, job title, company, email and telephone — to one executive search or advisory firm in your market, so that it may contact you about its services. We receive a fee from that firm for doing so. We cannot do this without your consent.

You can withdraw this consent at any time, free of charge, by emailing hello@chieffractional.com. We never collect or hold details of individual executives or candidates. See privacy and data and how we are paid.

We reply within one working day.