Security Engineer – GRC
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Security Engineer owning governance, risk, and compliance for Alan’s health insurance and prevention platform. Managing ISO 27001, DORA, HDS, audits, risk, and security automation.
Responsibilities:
- Own and operate the ISO 27001 Information Security Management System, including scope definition, Statement of Applicability, internal audit programme, and management review
- Translate DORA, HDS, RGPD, PGSSI-S, and other regulatory requirements into technical and operational security controls
- Lead security risk cartography using EBIOS RM and integrate it with the company-wide risk framework
- Facilitate risk workshops, produce treatment plans, and bring security risk analysis to broader risk forums
- Define the controls framework, set standards, track coverage, and distribute control ownership to operational teams
- Partner with Infrastructure, Platform, and Engineering on identity, network, secrets management, and logging security requirements
- Manage the security audit programme and coordinate with certification bodies and Internal Audit
- Run vendor security assessments and own the security dimension of third-party risk
- Provide technical security guidance on ANS, CERT Santé, and sensitive health-data requirements
- Classify and escalate ICT incidents, own BCP and DRP governance, and support DORA incident reporting
- Build a coherent compliance framework for ISO 27001, DORA, HDS, and NIS2 across multiple countries
- Develop automated audit and evidence pipelines integrated with engineering systems
- Build operational risk cartography using EBIOS RM to inform business and engineering decisions
- Automate evidence collection and control testing
- Configure and administer GRC tooling, workflows, and dashboards
- Assess cloud governance and policy-as-code controls
- Review architectures for identity, network segmentation, encryption, and logging gaps
- Interpret vulnerability data, drive remediation prioritization, and track resolution KPIs
- Collaborate with Legal, DPO, Internal Audit, Risk, Infrastructure, Platform, Engineering, Product, and Operations
Requirements:
- Experience owning and operating an ISO 27001 ISMS
- Led at least one full ISO 27001 certification or recertification cycle
- Knowledge of DORA, HDS, RGPD, PGSSI-S, NIS2, and AI Act requirements
- Experience translating regulatory requirements into technical and operational security controls
- Experience with security risk cartography using EBIOS RM
- Experience facilitating risk workshops and producing treatment plans
- Experience defining controls frameworks and tracking control coverage
- Experience working with Infrastructure, Platform, and Engineering teams on identity, network, secrets management, and logging controls
- Experience managing security audit programmes and coordinating with certification bodies
- Experience partnering with Internal Audit
- Experience conducting vendor security assessments and defining contractual security requirements, including security annexes and DPAs
- Understanding of ANS framework and CERT Santé requirements
- Experience with incident classification, escalation, BCP and DRP governance, and DORA incident reporting
- Experience scripting evidence collection and automating control testing using Python or similar
- Experience administering GRC platforms such as CISO Assistant, ServiceNow GRC, or Archer
- Understanding of cloud governance, shared responsibility in HDS-qualified environments, CSPM, and policy-as-code including OPA or SCP
- Ability to review architecture and identify gaps in identity, network segmentation, encryption, and logging
- Ability to interpret vulnerability scan outputs and prioritize remediation by business impact
- Ability to brief boards or audit committees on security risk
- Ability to influence Legal, DPO, Risk, Engineering, Product, and Operations without formal authority
- Ability to manage structured, traceable security programmes and roadmaps
- Must be legally eligible to work from France, Belgium, or Spain
- Fluent in English and French
Benefits:
- Attractive equity package on top of an above market-average base salary
- Remote work flexibility
- In-person collaboration opportunities
- Stimulating environment and perks
- Innovative working method
- Strong culture and cultural values guiding the approach to work
Similar Jobs
Associate Security Architect
Associate Security Architect detecting and mitigating cyberattacks for Akamai's managed security customers. Protecting digital properties through Akamai's distributed cloud, edge, and security platform.
Cloud Security Engineer
Cloud Security Engineer securing Azure infrastructure, identities, and AI workloads for a global IT transformation leader. Driving remediation, policy-as-code guardrails, and Microsoft Defender for Cloud posture improvement.
Portuguese Speaking Cybersecurity Customer Expert
Cybersecurity customer experts supporting Portuguese-speaking clients with security software and incident inquiries. Mercier Consultancy Group provides recruitment and BPO services across Europe.
Senior Cybersecurity Financial Compliance SME
Senior cybersecurity compliance SME ensuring DoW and Army audit readiness for ASRC Federal’s Vantage system. Applying NIST controls, FIAR requirements, and financial management overlays.
Security Architect
Arquiteto de Segurança da Informação na Verity, consultoria de transformação e engenharia digital. Projetando controles, riscos e práticas DevSecOps para ambientes Cloud e on-premises.
Security System Analyst – Lenel, Milestone
Security Systems Analyst supporting Lenel OnGuard and Milestone physical security systems for Securitas UK. Owning incident resolution, troubleshooting faults, and coordinating third-party engineers.
Signalling Security Specialist
Telecom signalling security specialist auditing telecom networks with PTA and supporting PTM IDS deployments. Delivering customer reports, presentations, troubleshooting, and operational improvements.
Cybersecurity Engineer
Cybersecurity Engineer automating cybersecurity operations, scripting, and API integrations for The Home Depot. Troubleshooting incidents and strengthening threat defense and access management.
Transit Safety Security Specialist
Transit safety specialist leading U.S. infrastructure safety, security, and certification projects for AECOM. Developing risk analyses, PTASPs, compliance documentation, and client training.
Manager, Cyber Security
Cyber Security Manager leading incident response, detection engineering, and security operations. Protecting Ping Identity’s cloud identity platform and enterprise systems.
Senior Domain Consultant – AI Security
AI Security Domain Consultant securing enterprise AI agents, applications, data, and supply chains. Leading customer PoVs, executive demos, architectures, and Prisma AIRS roadmap feedback.
Senior Security Architect – AD/Entra ID
Senior Security Architect securing Microsoft Active Directory and Entra ID environments for GuidePoint Security’s cybersecurity clients. Designing IAM architecture, automating administration and resolving complex identity security issues.
Information Security Engineer
Information Security Engineer securing Keyfactor’s cryptographic trust infrastructure. Managing monitoring, vulnerability assessments, incident response, and ISO 27001/SOC 2 compliance.
Cybersecurity Governance Analyst
Cybersecurity governance analyst developing enterprise policies, vendor risk assessments, and compliance controls. Supporting Agero’s digital driver assistance services through audits, remediation, and security awareness.
Senior Software Engineer – Security, Distributed Systems
Senior software engineer building backend distributed systems for RapidFort’s cybersecurity and software supply chain platform. Developing secure, scalable services across Linux, containers, Kubernetes, and cloud environments.
Staff Security Engineer, Proactive Security
Staff Security Engineer leading proactive security services, infrastructure protection, and secure engineering paths at DoorDash. Building resilient products for the technology and logistics company’s delivery network.
Managing Director, Enterprise Security Architecture – Engineering
Managing Director leading enterprise security architecture and cybersecurity platforms for The Cigna Group. Advancing cloud, DevSecOps, AI security, and cyber defense at scale.
Offensive Security Engineer / Penetration Tester
Offensive Security Engineer conducting web, mobile, Active Directory and cloud penetration tests for Genesis’s global product IT ecosystem. Building automation and AI-agent workflows for offensive security.
Senior Data Security Specialist – Data Security Strategy
Especialista sênior liderando estratégia de segurança e governança de dados corporativos. Proteção de informações sensíveis com DLP, DSPM, Purview e ambientes cloud.
Senior Manager, Global Security Technology
Global Security Technology leader shaping strategy, platforms, and modernization. Managing enterprise security projects, vendors, budgets, and global capability delivery for Johnson & Johnson healthcare operations.