Security Engineer – Governance, Risk & Compliance

About the role

Alan is building a new standard in prevention insurance and needs a Security Engineer to own its security governance and risk posture. You will work with legal, internal audit and risk teams to protect sensitive health data for over a million members.

Key responsibilities

• Own and operate the ISO 27001 Information Security Management System, including scope definition, Statement of Applicability, internal audit programme and management review.
• Translate regulatory requirements (DORA, HDS, GDPR, PGSSI‑S) into concrete security controls and ensure the programme meets regulator expectations.
• Lead ongoing security risk management using EBIOS RM, facilitate risk workshops, produce treatment plans and align security risk with the broader company risk framework.
• Define the controls framework, set standards and monitor coverage while delegating control ownership to product and engineering teams.

Required profile

• Proven experience leading at least one ISO 27001 certification or recertification cycle.
• Strong understanding of French and European health‑data regulations (DORA, HDS, GDPR, PGSSI‑S).
• Ability to work collaboratively across legal, audit, risk and engineering functions.

Required skills

• ISO 27001 implementation and management
• EBIOS RM risk methodology
• DORA, HDS, GDPR, PGSSI‑S regulatory knowledge
• Security risk assessment and treatment planning

What we offer

• Opportunity to shape security for a fast‑growing health‑insurance leader
• Collaborative, mission‑driven culture across Europe and Canada
• Competitive compensation and benefits package