GRC Security Engineer: ISO 27001 & DORA Lead

Alan; France; Hybride; EUR 83 000 - 100 000; Plein temps

Avantages offerts par ce poste

Remote work flexibility

Competitive compensation

Résumé du poste

Alan is building the new standard in prevention insurance and this role owns the security governance and risk posture for handling sensitive health data in highly regulated markets.

You will define ISO 27001 ISMS, manage audits, risk cartography and vendor security, and collaborate with Legal, Internal Audit, and Risk, as well as Infrastructure, Platform and Engineering to embed security by design.

Qualifications

• Translate risk into business language.
• Influence without blockers across Legal, DPO, Risk, Engineering, Product, and Operations.
• Manage programmes with audit‑grade rigor.
• Build a genuine security culture.
• Think in principles when frameworks shift (DORA, NIS2, AI Act).

Responsabilités

• Own ISO 27001 ISMS scope definition, authorised statements, and audit programmes.
• Lead security risk cartography and risk workshops with the risk function.
• Define and track security controls with Infrastructure, Platform and Engineering teams.
• Run audit cycles with Internal Audit and coordinate with certification bodies.
• Manage third‑party risk and security requirements with Risk function.
• Interpret health data regulations (ANS, CERT Santé) into technical controls.

Description du poste

Alan is building the new standard in prevention insurance and this role owns the security governance and risk posture for handling sensitive health data in highly regulated markets.

You will define ISO 27001 ISMS, manage audits, risk cartography and vendor security, and collaborate with Legal, Internal Audit, and Risk, as well as Infrastructure, Platform and Engineering to embed security by design.