Senior Security & GRC Engineer (Remote)

Alan; Lille; Hybride; EUR 90 000 - 130 000; Plein temps

Résumé du poste

Alan is seeking a Governance, Risk & Compliance leader to own the ISO 27001 ISMS, manage the risk programme, and partner with regulatory, privacy, and engineering teams. You will drive audits, vendor security, and incident governance in a fast‑growing health data environment with four regulators across multiple countries.

The role requires translating complex regulations into actionable controls, embedding security across platforms, and shaping Alan’s security culture with board exposure and

Qualifications

• Experience leading ISO27001 ISMS programmes and audits.
• Strong understanding of DORA, RGPD, HDS, NIS2.
• Ability to translate regulatory requirements into concrete controls.
• Proven track record in risk mapping and governance.
• Ability to drive security across multiple teams and vendors.

Responsabilités

• Own and operate ISO 27001 ISMS including scope, SoA, audit programme, and mgmt reviews.
• Be security expert on regulatory/privacy matters and translate requirements into controls.
• Run risk programme using EBIOS RM and produce treatment plans.
• Embed security requirements across Infrastructure, Platform and Engineering.
• Manage security audit programme and coordinate with cert bodies and internal audit.
• Define contractual security requirements for third parties and vendors.
• Understand ANS framework and CERT Santé requirements to translate into actions.
• Oversee incident governance, DORA reporting, and BCP/DRP governance.

Connaissances

Governance

Regulatory compliance

Risk management

Security architecture

Stakeholder management

Outils

CISO Assistant

ServiceNow GRC

Archer

CSPM tooling

Python scripting

Description du poste

Alan is seeking a Governance, Risk & Compliance leader to own the ISO 27001 ISMS, manage the risk programme, and partner with regulatory, privacy, and engineering teams. You will drive audits, vendor security, and incident governance in a fast‑growing health data environment with four regulators across multiple countries.

The role requires translating complex regulations into actionable controls, embedding security across platforms, and shaping Alan’s security culture with board exposure and