Security Lead

Roundtable; Paris; Híbrido; EUR 90.000 - 130.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Employee stock options

Health insurance

Meal card Swile

MacBook provided

Hybrid work model

Office in Paris/Toulouse/Luxembourg

RTT / 25 days off

Descripción de la vacante

Roundtable is hiring its first dedicated security professional to own and improve security across our tech stack and operations. You’ll partner with Platform, Engineering, Legal, and Operations to ensure secure practices from code to cloud and devices.

You will drive risk reduction, compliance with ISO 27001, DORA, and GDPR, and build scalable security controls while enabling fast delivery and responsible innovation.

Formación

• 6+ years in security across corporate IT, cloud, and product security.
• Experience with ISO 27001, DORA, or GDPR from the technical side.
• Ability to review IAM, secrets management, and IaC in cloud environments (GCP a plus).
• Able to code: scripts or automation; PRs when fixing is fastest.

Responsabilidades

• Own security posture of internal environment: laptops, Google Workspace, SaaS tools, and privileged access.
• Review sensitive PRs and architecture decisions; identify configuration gaps.
• Contribute to secure IaC patterns and software supply chain security.
• Lead security operations: pentests, vulnerability remediation, access reviews, and incident exercises.
• Maintain ISO 27001, DORA, GDPR readiness and evidence for audits.
• Run security awareness, phishing exercises, and onboarding for staff.

Conocimientos

Security

Cloud security

IAM

Scripting

OSINT

Auditing

English fluency

Herramientas

Terraform

GitHub Actions

Descripción del empleo

About the role

This is not a gatekeeper role. This is an enabler role. Your job is to find the secure way to say yes.

You’ll be the first person fully dedicated to security at Roundtable. That means the scope is intentionally broad: from a developer opening a PR, to the configuration of our Google Workspace, to what’s running on an employee’s laptop, all the way to ISO 27001 and DORA.

You won’t own all the implementation yourself. You’ll work closely with Platform, Engineering, Legal and Operations or external partners. But when it comes to security, you’ll be the person making sure nothing falls between the cracks.

What you’ll work on

Corporate & IT Security

• Own the security posture of our internal environment: laptops, MDM, Google Workspace, email, browsers, SaaS tools, privileged accounts and authentication.

• Keep our shadow IT under control, regularly review access and permissions, and make sure every critical tool has the right owners and administrators.

• Think about what happens when an employee account or laptop gets compromised, and continuously reduce the blast radius.

Product & Infrastructure Security

Work closely with our Engineering and Platform teams to make security part of how we build and operate Roundtable.

• Review sensitive PRs and architecture decisions

• Identify configuration gaps

• Improve IAM and secrets management

• Contribute to secure IaC patterns

• Keep an eye on dependencies, containers and our software supply chain

Security Operations & Resilience

Make sure our security controls don’t just exist on paper.

Own recurring security operations: pentests, vulnerability remediation, access reviews, restore tests, incident exercises, patching follow-ups and security monitoring.

If we say our database can be restored, you’ll make sure we’ve actually tried restoring it.

Risk, Compliance & Certifications

• Own the technical reality behind our ISO 27001, DORA and GDPR commitments.

• You’ll work with Probo and our Legal team, who already help us with the documentation and compliance framework. Your role is to make sure what we document reflects what actually happens.

• Maintain our risk register, coordinate recurring controls, collect evidence and make sure we are always ready for the next audit.

People Security

Security is also about how 70 people use technology every day.

• Own our security awareness program, phishing exercises and security onboarding.

• Help both technical and non-technical teams understand threats without turning security into bureaucracy.

• Build guardrails where possible instead of relying on people remembering rules.

Offensive Security & Exposure

Continuously ask: how would someone attack us?

• Maintain an inventory of what we expose to the Internet.

• Use OSINT, automated scanners, security tooling and AI against our own systems.

• Coordinate pentests and make sure their findings actually result in improvements.

Think through our worst-case scenarios:

• Data exfiltration

• Ransomware

• Account takeover

• Platform unavailability

Then work backwards.

Vendors & Customers

• Review the security posture of the services we depend on and understand what access they have to our systems and data.

• Help answer enterprise security questionnaires and be able to explain our architecture, controls and security posture to institutional clients.

Build Things

This is a hands-on role.

• Automate repetitive controls.

• Build internal security tooling.

• Write scripts.

• Open PRs.

• Improve our IaC.

• Connect APIs.

• Experiment with new security tools.

And when you find something interesting outside the strict security perimeter, from OSINT to internal tooling or competitive intelligence, explore it.

We don’t want someone spending their week updating spreadsheets.

We want someone who understands our attack surface, continuously makes it smaller, and can demonstrate that our security controls actually work.

You're a great match ifTechnical skills:6+ years in security, with hands-on work across corporate IT, cloud infrastructure and product security.You’ve been through ISO 27001, DORA or GDPR work from the technical side, and you know what an auditor checks.You know cloud environments well enough to review IAM, secrets management and IaC. GCP is a plus.You can code. Scripts, automation, a PR when it’s the fastest way to fix something.You think like an attacker: OSINT, exposure mapping, reading a pentest report and turning it into fixes.Experience in cyber audit is a plus.Fluent English.Mindset:Enabler. You look for the secure way to say yes.Startup mindset. You’re comfortable being the first security hire, with a wide scope and nobody to hand things off to.Pragmatism. You’d rather build a guardrail that works than write a policy nobody reads.Communication. You can explain a risk to a developer, to our Legal team and to an institutional client.

What we offerA front-row seat in a fast-growing startup shaping the future of investment operations - ranked 14th in the Sifted 250, which highlights Europe’s 250 startups with the highest percentage revenue growth over the past three yearsA quality-driven environmentAwesome colleagues with high ambitionsA culture of ownership, collaboration, learning and growthBeautiful offices in central Paris, Toulouse and Luxembourg + flexible remote options for people in other countriesCompetitive compensation (including an employee stock options plan)Other perks / terms and conditions :Time off: 25 days of holidays + RTT daysHealth insurance: Mutuelle Alan (50% covered by the company)Meals: A restaurant card with our partner Swile (10€ per workday)Tools: A MacBook is our standard working toolTransportation: Forfait Mobilité Douce (600€ /year)