Security Lead

Roundtable; Paris; Hybrid; EUR 110,000 - 150,000; Full time

Benefits offered by this job

Stock options

Paris office in central location

Flexible remote options

Job summary

Roundtable is hiring its first dedicated security expert to own corporate, product and operations security. You will shape security posture across devices, IAM, and cloud, and work with Platform, Engineering, Legal and external partners to ensure a secure-by-design culture.

The role covers governance, risk, and compliance, including ISO 27001, GDPR, and security testing. Paris offices with flexible remote options are offered.

Qualifications

• 6+ years in security with hands-on work across corporate IT, cloud infrastructure and product security.
• Experience with ISO 27001, DORA or GDPR work from the technical side and auditors’ checks.
• Strong ability to explain risk to developers, Legal and institutional clients; fluent English.

Responsibilities

• Own the security posture of our internal and product environments across laptops, incident response and access reviews.
• Collaborate with Platform, Engineering, Legal and Operations to embed security in design and operations.
• Lead risk, compliance and certification activities including ISO 27001 and GDPR readiness.

Skills

Security governance

GCP security

IAM management

Secrets management

IaC patterns

Security tooling

OSINT

English fluency

Tools

GCP

Job description

This is not a gatekeeper role. This is an enabler role. Your job is to find the secure way to say yes.

You’ll be the first person fully dedicated to security at Roundtable. That means the scope is intentionally broad: from a developer opening a PR, to the configuration of our Google Workspace, to what’s running on an employee’s laptop, all the way to ISO 27001 and DORA.

You won’t own all the implementation yourself. You’ll work closely with Platform, Engineering, Legal and Operations or external partners. But when it comes to security, you’ll be the person making sure nothing falls between the cracks.

About the role

This is not a gatekeeper role. This is an enabler role. Your job is to find the secure way to say yes.

You’ll be the first person fully dedicated to security at Roundtable. That means the scope is intentionally broad: from a developer opening a PR, to the configuration of our Google Workspace, to what’s running on an employee’s laptop, all the way to ISO 27001 and DORA.

You won’t own all the implementation yourself. You’ll work closely with Platform, Engineering, Legal and Operations or external partners. But when it comes to security, you’ll be the person making sure nothing falls between the cracks.

What you’ll work on

Corporate & IT Security

• Own the security posture of our internal environment: laptops, MDM, Google Workspace, email, browsers, SaaS tools, privileged accounts and authentication.

• Keep our shadow IT under control, regularly review access and permissions, and make sure every critical tool has the right owners and administrators.

• Think about what happens when an employee account or laptop gets compromised, and continuously reduce the blast radius.

Product & Infrastructure Security

Work closely with our Engineering and Platform teams to make security part of how we build and operate Roundtable.

• Review sensitive PRs and architecture decisions

• Identify configuration gaps

• Improve IAM and secrets management

• Contribute to secure IaC patterns

• Keep an eye on dependencies, containers and our software supply chain

You don’t need to operate the entire infrastructure yourself. Your job is to understand it well enough to challenge it and improve it.

Security Operations & Resilience

Make sure our security controls don’t just exist on paper.

Own recurring security operations: pentests, vulnerability remediation, access reviews, restore tests, incident exercises, patching follow-ups and security monitoring.

If we say our database can be restored, you’ll make sure we’ve actually tried restoring it.

Risk, Compliance & Certifications

• Own the technical reality behind our ISO 27001, DORA and GDPR commitments.

• You’ll work with Probo and our Legal team, who already help us with the documentation and compliance framework. Your role is to make sure what we document reflects what actually happens.

• Maintain our risk register, coordinate recurring controls, collect evidence and make sure we are always ready for the next audit.

People Security

Security is also about how 70 people use technology every day.

• Own our security awareness program, phishing exercises and security onboarding.

• Help both technical and non-technical teams understand threats without turning security into bureaucracy.

• Build guardrails where possible instead of relying on people remembering rules.

Offensive Security & Exposure

Continuously ask: how would someone attack us?

• Maintain an inventory of what we expose to the Internet.

• Use OSINT, automated scanners, security tooling and AI against our own systems.

• Coordinate pentests and make sure their findings actually result in improvements.

Think through our worst-case scenarios:

• Data exfiltration

• Ransomware

• Account takeover

• Platform unavailability

Then work backwards.

Vendors & Customers

• Review the security posture of the services we depend on and understand what access they have to our systems and data.

• Help answer enterprise security questionnaires and be able to explain our architecture, controls and security posture to institutional clients.

Build Things

This is a hands-on role.

• Automate repetitive controls.

• Build internal security tooling.

• Write scripts.

• Open PRs.

• Improve our IaC.

• Connect APIs.

• Experiment with new security tools.

And when you find something interesting outside the strict security perimeter, from OSINT to internal tooling or competitive intelligence, explore it.

We don’t want someone spending their week updating spreadsheets.

We want someone who understands our attack surface, continuously makes it smaller, and can demonstrate that our security controls actually work.

You’re a great match if

Technical skills:

• 6+ years in security, with hands-on work across corporate IT, cloud infrastructure and product security.

• You’ve been through ISO 27001, DORA or GDPR work from the technical side, and you know what an auditor checks.

• You know cloud environments well enough to review IAM, secrets management and IaC. GCP is a plus.

• You can code. Scripts, automation, a PR when it’s the fastest way to fix something.

• You think like an attacker: OSINT, exposure mapping, reading a pentest report and turning it into fixes.

• Experience in cyber audit is a plus.

• Fluent English.

Mindset:

• Enabler. You look for the secure way to say yes.

• Startup mindset. You’re comfortable being the first security hire, with a wide scope and nobody to hand things off to.

• Pragmatism. You’d rather build a guardrail that works than write a policy nobody reads.

• Communication. You can explain a risk to a developer, to our Legal team and to an institutional client.

What we offer

• A front-row seat in a fast-growing startup shaping the future of investment operations - ranked 14th in the Sifted 250, which highlights Europe’s 250 startups with the highest percentage revenue growth over the past three years

• quality-driven environment

• Awesome colleagues with high ambitions

• A culture of ownership, collaboration, learning and growth

• Beautiful offices in central Paris, Toulouse and Luxembourg + flexible remote options for people in other countries

• Competitive compensation (including an employee stock options plan)

• Other perks / terms and conditions :

  • Time off: 25 days of holidays + RTT days

  • Health insurance: Mutuelle Alan (50% covered by the company)

  • Meals: A restaurant card with our partner Swile (10€ per workday)

  • Tools: A MacBook is our standard working tool

  • Transportation: Forfait Mobilité Douce (600€ /year)

• First interview with our Talent Recruiter

• Second interview with Simon, our Founder & CTO

• Case study with a tech team member

• Cultural fit with another founder

Roundtable is committed to creating a diverse environment. All qualified applicants will receive consideration for employment irrespective of gender, origins, identity, background, and orientations. We encourage all applicants, especially those from underrepresented groups, to apply for our open positions. We believe that diversity, equity and inclusion are fundamental pillars.