Security Engineer Senior - GRC

Alan; United States; À distance; USD 150 000 - 210 000; Plein temps

Résumé du poste

Alan is building the next standard in prevention insurance, and this role focuses on owning security governance and risk across the organization. You will set direction, triage risk, and drive controls that keep member data secure as the company scales across countries and regulators.

You will mentor a junior GRC engineer and grow the team, shaping governance practices that support rapid product and business growth while maintaining the highest standards of security and compliance.

Qualifications

• Extensive experience leading security governance across an organization.
• Strong track record in risk management and regulatory compliance.
• Experience with ISO 27001 and certifications; familiarity with HDS a plus.

Responsabilités

• Own the security governance framework end-to-end and drive adoption.
• Lead regulatory risk discussions and translate rules into practical controls.
• Manage ongoing risk programs including AI-related risks and business continuity.
• Define and communicate the controls framework; empower teams to own controls.
• Own incident governance, triage incidents, and coordinate continuity and disaster recovery plans.

Connaissances

Security governance

Risk management

ISO 27001

HDS

AI risk governance

Incident management

Description du poste

Health can't wait. Not for symptoms to get worse. Not for a six-month appointment. Not for a system to catch up. But that's exactly how healthcare works today. You wait, until you can't.Alan exists to end the wait.Health is a universal right, and we believe this right can only become real when it's coupled with prevention. We need to stop treating health as something we repair and start treating it as something we build, every day. It's not solely a question of willpower. It's the healthcare system itself that needs to work for everyone, in a sustainable way. So we are building the new standard in prevention insurance. Alan is the first company that integrates insurance, prevention, and care into a single, acclaimed user experience. We are on an incredible journey to build a global leading company, with a unique culture. We already partner with 40K+ companies of all sizes, serving more than 1M+ members, and have reached €800M+ in ARR. Prevention as the new norm. That's what we're building with our team of 1000+ people. If it speaks to you: we're hiring across France, Spain, Belgium, and Canada. And beyond.

The role

Most GRC roles are about keeping auditors happy. This one is about earning our members' trust: every day, they share their diagnoses, their claims and their care with us. You'll own security governance and risk at Alan end to end. That means one clear framework across our certifications and regulations, which the whole company uses to decide what matters most. You set the direction, make the calls on risk, and help every team own its part. We just earned our HDS certification, and there's much more to build as we grow from 1M to many millions of members, across more countries and regulators. That includes how we govern AI, which Alan uses across its products and operations. This is a hands-on senior role. You do the work yourself, mentor the junior GRC engineer we're hiring alongside you, and grow the team over time.

What you'll do

• Make our security framework a tool for the whole company. You own the full certification cycle (ISO 27001, HDS and those to come), and turn it into something teams use every day to prioritise, not a binder for auditors.
• Bring the security view on regulation. Legal and Risk own the regulatory relationships. You bring the security answer: what the rules mean for how we protect data, and which controls make it work in practice.
• Run risk as an ongoing programme. You map and prioritise security risks, including AI risks, turn them into clear treatment plans, and feed them into company-wide risk decisions with the Risk team.
• Help every team own its risks. You define the controls framework and the standards, while the teams who build and run our systems own the controls. You brief the board and audit committee, and you know which findings need an urgent call and which can wait for the quarterly report.
• Own incident governance. You triage and elevate incidents, own business continuity and disaster recovery, and shape the