Alan - Security Engineer Senior - GRC
Requirements
• Your team You'll join Alan's Corporate team, which brings together our control functions: Risk, Corporate Governance & Internal Control, Legal, Compliance and Security. They share one mission: building what lets Alan operate at scale, safely and responsibly. Within that group, you carry the security governance and risk dimension, working hand in hand with the security engineers who run our infrastructure and platform security, and with a junior GRC engineer we're hiring alongside you. You'll be hands-on every day, building and owning the work yourself. Along the way, you'll mentor the junior engineer and help shape how GRC grows at Alan. • You want to build and own things yourself, and you enjoy helping someone else grow while you do it. • 6+ years in security, with real GRC ownership. • You've run a GRC roadmap in a certified or strongly regulated environment (ISO 27001, HDS, SOC 2, or regulated sectors like health, insurance or finance). You're comfortable working with certification auditors, and you can explain what a framework requires and why it makes sense for business teams. • You take a stand on risks, and you'd rather close one real risk than write ten policies. • You're fluent in French and English. • You've driven a certification or audit cycle end to end yourself. • You've automated compliance work, or you're eager to, and you have a view on where AI can help. • You've presented risk to senior leaders or a board. • You've mentored or onboarded someone before. • Location: You must be legally eligible to work from France, Belgium or Spain. • Remote work: We offer remote work flexibility. • 🎯 IMPORTANT NOTE: WE HIRE PEOPLE, NOT ROLES. • If you're excited about this opportunity but don't check every box, we'd love to hear from you. Everyone, no matter how underrepresented, should feel free to apply, as it can only bring learnings or success. • Remember, this is just a guide, not a checklist. We'll be thrilled to receive your application! • 🔖 Check out our About Alan https://alan.com/about and Career https://alan.com/careers pages, as well as our Medium https://medium.com/alan, blog https://blog.alan.com/ and Glassdoor page https://www.glassdoor.com/Overview/Working-at-Alan-EI_IE1696043.11,15.htm for more info.
Responsibilities
• Make our security framework a tool for the whole company. You own the full certification cycle (ISO 27001, HDS and those to come), and turn it into something teams use every day to prioritise, not a binder for auditors. • Bring the security view on regulation. Legal and Risk own the regulatory relationships. You bring the security answer: what the rules mean for how we protect data, and which controls make it work in practice. • Run risk as an ongoing programme. You map and prioritise security risks, including AI risks, turn them into clear treatment plans, and feed them into company-wide risk decisions with the Risk team. • Help every team own its risks. You define the controls framework and the standards, while the teams who build and run our systems own the controls. You brief the board and audit committee, and you know which findings need an urgent call and which can wait for the quarterly report. • Own incident governance. You triage and escalate incidents, own business continuity and disaster recovery, and shape the security side of our regulatory incident reports. • Be a credible partner to engineering. You work with engineering teams early on new designs and spot control gaps (access, encryption, logging) before they ship. You don't need to be an architect, but you can hold the conversation. • 🏗️ WHAT YOU'LL BUILD • One governance model: clear ownership of risks and controls across teams, so security decisions don't bottleneck on one person. • A living risk map: prioritised risks that actually drive company and engineering decisions. • One compliance backbone: a single control system across our countries and regulators, built to scale. • An automated evidence engine: evidence collected straight from engineering systems, so audits run continuously instead of as a quarterly rush. • You'll work closely with Legal, the Data Protection Officer, Internal Audit and Risk, and day to day with engineering and operations teams.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT