Security Governance & Compliance Engineer (Remote)

Alan; Aix-les-Bains; Hybride; EUR 120 000 - 180 000; Plein temps

Avantages offerts par ce poste

Remote work flexibility

In-person collaboration

Résumé du poste

Alan is hiring a Governance, Risk & Compliance leader who owns ISO 27001 ISMS and drives DORA, HDS, RGPD compliance across multiple countries. You will translate complex regulations into practical controls, manage risk using EBIOS RM, and partner with Legal, DPO, Internal Audit, and Risk to raise the security posture of a 1M+ members health data platform.

This role blends policy, architecture and operations, with oversight of incident governance, vendor risk, and audit cycles.

Qualifications

• Led at least one full ISO 27001 certification or recertification cycle.
• Translate regulatory requirements into practical security controls.
• Run security risk mapping using EBIOS RM.
• Partner with Legal, DPO, Internal Audit and Risk functions.
• Oversee incident governance and DORA reporting.

Responsabilités

• Own ISO 27001 ISMS scope, SoA, internal audits and management reviews.
• Translate regulatory requirements into practical security controls.
• Lead security risk mapping using EBIOS RM.
• Define and manage security controls with engineering teams.
• Manage security audit program with Internal Audit and certification bodies.
• Oversee third‑party security assessments and vendor risk.
• Ensure compliance with ANS, CERT Santé in day-to-day ops.
• Support DORA incident reporting and BCP/DRP governance.

Connaissances

Security governance

Regulatory compliance

Risk management

ISO 27001 ISMS

DORA

HDS

RGPD

Audit management

Third-party risk

Outils

CISO Assistant

ServiceNow GRC

Archer

Description du poste

Alan is hiring a Governance, Risk & Compliance leader who owns ISO 27001 ISMS and drives DORA, HDS, RGPD compliance across multiple countries. You will translate complex regulations into practical controls, manage risk using EBIOS RM, and partner with Legal, DPO, Internal Audit, and Risk to raise the security posture of a 1M+ members health data platform.

This role blends policy, architecture and operations, with oversight of incident governance, vendor risk, and audit cycles.