IT & Security Lead (RSSI)

Dolead; Paris; Híbrido; EUR 90.000 - 130.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Health insurance

Lunch voucher

Vacations 25 days

RTT 8 days

Remote policy

Company events

Paris center offices

Descripción de la vacante

Dolead recherche un IT & Security Lead (RSSI) à Paris, en CDI, mode hybride, pour bâtir un cadre de sécurité pratique et robuste. Vous définirez les règles et les mettrez en pratique avec les équipes Engineering, RH, Legal et les métiers en France et aux États‑Unis.

Vous serez responsable de l’accès, de la surveillance, et de la sécurité des outils SaaS; vous travaillerez en étroite collaboration avec les partenaires IT et les équipes médias pour protéger les données et les comptes publicitaires.

Formación

• Expérience en gouvernance de la sécurité et amélioration des processus de sécurité.
• Connaissance approfondie des outils SaaS et de la sécurité des identités.

Responsabilidades

• Définir et mettre en œuvre des politiques de sécurité pratiques couvrant le partage de données, la gestion des mots de passe, l’utilisation des appareils, les contrôles d’accès et la continuité des activités.
• Structurer la gouvernance de la sécurité, réaliser une évaluation des risques et prioriser les améliorations par impact métier.
• Établir des guidelines claires pour les outils IA et les applications tierces, en équilibrant innovation et protection des données.
• Évaluer les risques de sécurité liés aux nouveaux fournisseurs, outils et services.
• Posséder la gouvernance d’accès sur notre environnement SaaS (Google Workspace, Slack, Notion, ClickUp).
• Renforcer la gestion des identités et des accès via SSO, MFA, contrôles d’accès privilégiés et revues régulières.
• Sécuriser les comptes publicitaires et les plateformes (Meta, Google Ads, TikTok), en collaboration avec les équipes média.
• Mettre en place onboarding/offboarding avec les RH pour maîtriser les droits d’accès.
• Repérer et réduire l’exposition à la sécurité, des apps non autorisées aux configurations partagées.
• Améliorer la surveillance de la sécurité et les logs pertinents.
• Conduire les évaluations de vulnérabilités et les remédiations; supports des revues d’incidents.
• Collaborer avec DevOps sur la sécurité du cloud et le développement sûr.
• Automatiser les vérifications récurrentes avec des scripts/outils simples.
• Coordonner avec le prestataire IT externe pour sécuriser les postes et les appareils.
• Convertir les risques techniques en priorités actionnables sans complexité inutile.
• Sensibiliser et faire adopter les processus de sécurité dans les équipes.
• Collaborer avec le service juridique sur le GDPR et les exigences US en matière de confidentialité.
• Préparer les clients et audits (ISO 27001 / SOC 2).
• Contribuer aux évaluations clients et à la préparation des cadres de sécurité.

Conocimientos

Security governance

SaaS security

SSO et MFA

Identity management

Python / Bash scripts

GDPR compliance

ISO 27001 / SOC 2

Cloud security

Stakeholder management

Français & Anglais

Herramientas

Google Workspace

Slack

Notion

ClickUp

Descripción del empleo

IT & Security Lead (RSSI)

Paris, France | Full-time (CDI) | Hybrid

At Dolead, we align marketing, sales, and data to turn media investment into real business results. We launch paid campaigns faster, connect customer data with confidence, and deliver sales-ready leads at a fixed cost per lead.

We already support 200+ clients across 15 countries, with a team of 70+ experts from 13 nationalities across Europe and North America.

Our teams move fast. New tools, AI platforms, and automation are part of how we work every day. But moving fast also means making sure our systems, access, and data are properly secured.

That's where you come in.

We're looking for our first IT & Security Lead (RSSI) to build a practical, reliable security framework across Dolead.

This is a role with genuine ownership: defining the right rules, putting them into practice, and making sure they work for the people using them.

You'll collaborate closely with Engineering, HR, Legal, Operations, and our business teams across France and the US, alongside our external IT partner.

Your missions

1. Build our security foundations

• Define and implement practical security policies covering data sharing, password management, device usage, access controls, and business continuity.
• Structure security governance, maintain a risk assessment and prioritize improvements based on their actual business impact.
• Establish clear guidelines for AI tools and third-party applications, balancing innovation with data protection.
• Assess security risks associated with new vendors, tools, and services.

2. Secure our tools and critical accounts

• Own access governance across our SaaS environment, including Google Workspace, Slack, Notion, ClickUp, and other platforms.
• Strengthen identity and access management through SSO, MFA, privileged access controls, and regular access reviews.
• Secure business-critical advertising accounts, including Meta, Google Ads, TikTok, and other platforms, in collaboration with our media teams.
• Build reliable onboarding and offboarding processes with HR to ensure access is properly granted, reviewed, and revoked.

3. Identify risks and improve security controls

• Detect and reduce security exposure, from unauthorized applications to misconfigured sharing permissions and third-party integrations.
• Improve security monitoring, identifying relevant logs, alerts, and recurring checks.
• Coordinate vulnerability assessments, remediation plans, and external security testing where appropriate.
• Support incident reviews and turn findings into concrete improvements.

4. Work hands-on with Engineering and IT partners

• Collaborate with DevOps on cloud security, secrets management, infrastructure configurations, and secure development practices.
• Automate recurring security checks through scripts and lightweight tools.
• Coordinate with our external IT provider to maintain appropriate endpoint and device security standards.
• Translate technical risks into actionable priorities, without introducing unnecessary complexity.

5. Make security part of how we work

• Build security awareness across teams through practical guidelines, training, and ongoing support.
• Drive adoption of security processes, making sure policies are understood and consistently applied.
• Partner with Legal on GDPR and relevant US privacy requirements, including data protection and consent-related topics.
• Support client security assessments and help structure our readiness for frameworks such as ISO 27001 or SOC 2.

What you'll focus on first

Your initial priorities will be to:

• Map our tools, critical accounts, existing controls, and main security risks.
• Strengthen access management, particularly onboarding, offboarding, and privileged accounts.
• Establish practical policies for data sharing and AI tools.
• Build a prioritized security action plan with clear owners and follow-up.

The objective isn't to introduce complexity for its own sake. It's to create security foundations that can grow with the business.

Your profile

We're looking for someone who combines security expertise, technical understanding, and a pragmatic mindset.

• Solid experience in IT security or security governance, with a track record of building, owning, and improving security processes.
• Strong SaaS and identity security knowledge, including SSO, MFA, access management, and Google Workspace.
• Hands-on technical abilities, with the confidence to investigate configurations, automate checks using Python, Bash, or similar tools, and collaborate with engineering teams.
• Understanding of security and privacy frameworks, including GDPR, relevant US privacy regulations, and standards such as ISO 27001, SOC 2, or CIS Controls.
• Proven ability to turn policies into practice, getting teams to adopt new processes rather than simply documenting them.
• Pragmatic approach to risk, knowing how to prioritize what matters in a fast-moving, 70-person company.
• Strong communication and stakeholder management skills, with the confidence to challenge decisions constructively.
• Fluent French and English, both mandatory for working with our international teams.

Nice to have

• Experience in a startup, scale-up, or similarly agile environment.
• Familiarity with advertising platform security (Meta Business Manager, Google Ads, TikTok Business Center).
• Security certifications such as CISSP, CISM, or equivalent.

Our recruitment process

1. Introductory conversation with Florian, Talent Acquisition : to discuss your experience, expectations, and interest in Dolead.
2. Interview with Antoine, Software Architect : to explore your approach to security governance, technical foundations, and real-world challenges.
3. Practical case discussion : to work through a realistic security scenario and discuss how you would approach your first 90 days.
4. Final interview with Vlad, CTO : to align on the role, its priorities, and the impact you could have at Dolead.

Benefits

• SideCare health insurance, fully covered by Dolead
• Lunch Voucher: Swile lunchcard - 13€/day - 50% coverage by Dolead
• Holidays: 25 vacation days & 8 RTT
• Flexible remote policy: up to 2-4 days/week (depending on the team organization)
• Multicultural environment: +13 nationalities represented
• Strong company culture, monthly team & company events!
• Offices: Located in the center of Paris (near Opéra)

We aim to keep the process transparent and useful on both sides. You will know what each step is designed to assess and have the opportunity to meet the people you would work with.

Dolead is an equal-opportunity employer. We welcome applicants from all backgrounds and make hiring decisions based on skills, experience and potential.