Security Engineer Junior - GRC

Alan; United States; Remote; USD 90,000 - 120,000; Full time

Job summary

Alan is hiring for a Governance, Risk and Compliance (GRC) specialist to join our security team. You will manage ISO 27001, HDS, and DORA audits across multiple countries, translating regulations into concrete actions and maintaining rigorous health-data governance.

You will collaborate with Legal, the DPO, and product teams to ensure continuous compliance, oversee risk mappings, and support incident governance as we scale our member base and operations.

Qualifications

• Experience implementing and maintaining ISO 27001, HDS and DORA audit cycles.
• Knowledge of GDPR and health data governance.
• Familiarity with health sector frameworks (ANS, HDS).

Responsibilities

• Keep ISO 27001 and HDS certifications on track, manage evidence collection and corrective actions.
• Translate regulations into actionable tasks with Legal and DPO, tracking completion.
• Build knowledge of health data regulations and apply to governance practices.
• Contribute to risk mapping, including AI risks, and follow up on mitigation plans.
• Support teams owning controls, answering questions and communicating clearly across stakeholders.
• Assist incident governance, classify incidents, and maintain continuity planning.

Skills

Regulatory compliance

Risk management

Information security

Audits

Education

Bachelor's degree

Tools

Audit management software

Governance tools

Job description

Health can’t wait. Not for symptoms to get worse. Not for a six‑month appointment. Not for a system to catch up. But that’s exactly how healthcare works today. You wait, until you can’t. Alan exists to end the wait. Health is a universal right, and we believe this right can only become real when it’s coupled with prevention. We need to stop treating health as something we repair and start treating it as something we build, every day. It’s not solely a question of willpower. It’s the healthcare system itself that needs to work for everyone, in a sustainable way.

So we are building the new standard in prevention insurance. Alan is the first company that integrates insurance, prevention, and care into a single, acclaimed user experience. We are on an incredible journey to build a global leading company, with a unique culture. We already partner with 40K+ companies of all sizes, serving more than 1M+ members, and have reached €800M+ in ARR. Prevention as the new norm. That's what we're building with our team of 1000+ people. If it speaks to you: we're hiring across France, Spain, Belgium, and Canada. And beyond.

The role

Most GRC roles are about keeping auditors happy. This one is about earning our members' trust: every day, they share their diagnoses, their claims and their care with us. You'll join Alan's security team to help run our compliance and risk work across ISO 27001, HDS and DORA, across a growing number of countries and regulators. We just earned our HDS certification, and there's much more to build, including how we govern AI across our products: assessing AI risks, setting the controls, and keeping up with the AI Act. You'll learn alongside experienced security engineers, with a dedicated coach from day one. You'll take on real ownership early, and your scope grows as we scale from 1M to many millions of members. And you'll learn how we work at Alan: teams own their risks and controls, we automate wherever we can, and we focus on real outcomes, not paperwork.

What you’ll do

• Keep our certifications on track. You run the day-to-day of the ISO 27001 and HDS audit cycles: collecting evidence, preparing internal audits, and following up on corrective actions until they're closed.
• Turn regulations into practical actions. With Legal and the DPO, you help translate requirements like DORA, HDS, and GDPR into clear tasks for the teams, and track that they get done.
• Learn the health sector rules. You build your knowledge of health-specific frameworks (ANS, HDS) and help apply them to how we handle health data.
• Contribute to risk management. You help build and update our risk mapping, including AI risks, and follow up on the treatment plans with the teams who own them.
• Support the teams who own the controls. You keep the controls framework up to date, answer teams' questions, and help explain security clearly to every stakeholder, from engineers to managers.
• Support incident governance. You help classify and document incidents, keep Business continuity and