Security Compliance, GRC Engineer

Mistral.ai; Paris; Sur place; EUR 70 000 - 110 000; Plein temps

Avantages offerts par ce poste

Healthcare coverage

Relocation support

Wellness programs

Meal & transportation allowances

Résumé du poste

Mistral.ai is seeking a GRC Engineer to design, implement, and maintain GRC programs ensuring regulatory, security, and risk obligations are met. You will automate compliance workflows, monitor risks, and enforce governance policies across cloud and on-prem environments.

You will collaborate with IT, Security, Legal, and Business units to integrate GRC tools, develop dashboards, and streamline audits. Fluent English required; French a plus.

Qualifications

• 5+ years in GRC, IT audit, cybersecurity, or related field.
• Hands-on experience with GRC tools.
• Deep knowledge of compliance frameworks (ISO 27001, SOC 2, NIST CSF, COBIT) or GDPR/NIS2/HIPAA.
• Proficiency in scripting and automation to streamline GRC processes.
• Strong understanding of IT controls, risk assessment methodologies, and security best practices.
• Experience with SIEM, IAM, or vulnerability management tools.
• Familiarity with cloud security and compliance (AWS, Azure, GCP).
• Ability to analyze complex data and derive insights.
• Creative and pragmatic approach to addressing GRC challenges.
• Rigor in documentation, controls, and compliance evidence.
• Ability to work with cross-functional teams.
• Clear written and verbal communication; English fluent; French a plus.
• Certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Auditor/Implementer.

Responsabilités

• Automate GRC workflows to streamline compliance monitoring, evidence collection, risk assessments and tests.
• Integrate GRC tools with SIEM, IAM, and ticketing systems for real-time monitoring.
• Develop dashboards and reports for real-time compliance visibility.
• Automate control testing and validation across IT controls.
• Enforce policy-as-code across cloud and on-prem environments.
• Automate risk assessments by linking vulnerability scanners with GRC platforms.
• Streamline audit evidence collection for internal and external audits.
• Implement continuous compliance monitoring with automated alerts.
• Automate third-party risk management workflows including questionnaires and scoring.
• Enhance incident response with automation in collaboration with Security teams.
• Maintain and optimize GRC tools for scalability and performance.

Connaissances

GRC tools

Scripting & automation

IT controls

Risk assessment

Security best practices

SIEM/IAM/vulnerability tools

Cloud security & compliance

Communication skills

Certifications (CISSP/CISM/CRISC/CISA)

Outils

SIEM

IAM

Description du poste

About Mistral

Mistral provides full-stack AI solutions: from frontier models to developer tools, applications, and compute. We partner with enterprises tackling the hardest problems—across high-stakes industries like finance, manufacturing, defense, healthcare, and the public sector—co-creating customized AI systems that they can run on their terms.

We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between Europe, North America, Asia and the Middle East. We are creative, low-ego and team-spirited.

Role Summary

As a GRC Engineer, you will be at the heart of Mistral’s Governance, Risk, and Compliance (GRC) program. You will design, implement, and maintain the technical and operational frameworks that ensure our organization meets its regulatory, security, and risk management obligations.

Your role will involve collaborating with cross-functional teams to automate compliance processes, monitor risks, and enforce governance policies. You will play a key role in ensuring that our systems, processes, and controls align with industry standards and regulatory requirements.

What you will do

• Automate GRC workflows: Design, develop, and deploy automation scripts and tools to streamline compliance monitoring, evidence collection, risk assessments, and control testing.

• Integrate GRC tools with existing systems: Build and maintain integrations between GRC platforms and other enterprise systems (e.g., SIEM, IAM, or ticketing tools) to enable real-time risk and compliance monitoring.

• Develop custom dashboards and reports: Create automated dashboards to provide real-time visibility into compliance status, risk exposure, and control effectiveness for stakeholders.

• Automate control testing and validation: Implement automated control testing for technical controls (e.g., access reviews, patch management, or configuration compliance) to reduce manual effort and improve accuracy.

• Enforce policy-as-code: Embed compliance and security policies directly into cloud and on-premise environments, ensuring consistent enforcement across systems.

• Automate risk assessments: Develop workflows to automate the identification and prioritization of risks, such as integrating vulnerability scanning tools with GRC platforms to flag high-risk assets automatically.

• Streamline audit evidence collection: Automate the gathering and organization of audit evidence (e.g., logs, configuration files, or access records) to support internal and external audits, reducing preparation time and minimizing errors.

• Implement continuous compliance monitoring: Set up automated alerts and triggers for non-compliance events (e.g., unauthorized access, misconfigurations, or policy violations)

• Automate third-party risk management: Build workflows to automate vendor risk assessments, including sending questionnaires, scoring responses, and escalating high-risk vendors for review.

• Enhance incident response with automation: Collaborate with Security teams to automate incident response processes, such as triggering remediation workflows for identified risks or compliance gaps.

• Maintain and optimize GRC tools: Continuously improve GRC platforms by automating routine tasks (e.g., user access reviews, control attestations) and enhancing their scalability and performance.

About you

• 5+ years in Governance, Risk, and Compliance (GRC), IT audit, cybersecurity, or a related field.

• Hands-on experience with GRC tools.

• Deep knowledge of compliance frameworks such as ISO 27001, SOC 2, NIST CSF, COBIT, or regulatory requirements like GDPR, NIS2, or HIPAA.

• Proficiency in scripting and automation to streamline GRC processes.

• Strong understanding of IT controls, risk assessment methodologies, and security best practices.

• Experience with SIEM, IAM, or vulnerability management tools.

• Familiarity with cloud security and compliance (e.g., AWS, Azure, or GCP security controls).

• Ability to analyze complex data, identify trends, and develop actionable insights.

• Creative and pragmatic approach to addressing GRC challenges.

• Rigor in managing documentation, controls, and compliance evidence.

• Ability to work effectively with cross-functional teams, including IT, Security, Legal, and Business units.

• Clear and concise written and verbal communication skills, with the ability to explain technical concepts to non-technical stakeholders and vice-versa

• Professional proficiency in English; French proficiency is a plus..

• Certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Auditor/Implementer

What We Offer

We offer a comprehensive benefits package designed to support your well-being, growth, and work-life balance. Benefits vary by country and may include healthcare coverage, parental leave, retirement plans, relocation support, wellness programs, meal and transportation allowances, and other location-specific perks.

For the most up-to-date details on benefits available in your location, please refer to our Benefits page.

Privacy Policy

Your privacy matters to us. You can learn more about how we handle your personal data in our Applicant Privacy Policy.

Find more English Speaking Jobs in France on Arbeitnow