Security Engineer – Governance, Risk & Compliance

About the role

Alan is building a new standard in preventive health insurance and needs a Security Engineer focused on Governance, Risk & Compliance (GRC) to protect sensitive health data. You will own the company’s security governance and risk posture, ensuring compliance with French and European regulations while supporting a fast‑growing, cross‑border team.

Key responsibilities

• Define, implement and maintain the ISO 27001 Information Security Management System (ISMS), including scope, Statement of Applicability, internal audit programme and management reviews.
• Translate regulatory requirements (DORA, HDS, RGPD, PGSSI‑S) into concrete security controls and work with Legal and Risk to close gaps.
• Lead continuous security risk assessments using the EBIOS RM methodology and integrate findings into the company‑wide risk framework.
• Facilitate risk workshops, produce treatment plans and ensure security risks are evaluated alongside business risks.
• Design and govern the controls framework, delegating ownership to product and infrastructure teams while tracking coverage and effectiveness.

Required profile

• Proven experience managing an ISO 27001 certification or recertification cycle.
• Strong understanding of French/European health‑data regulations (DORA, HDS, RGPD, PGSSI‑S).
• Hands‑on experience with security risk methodologies, preferably EBIOS RM.
• Ability to work collaboratively with Legal, Internal Audit and broader Risk functions.

Required skills

• ISO 27001
• EBIOS RM

What we offer

• Opportunity to shape security for a fast‑growing health‑tech company serving over 1 million members.
• Collaborative, mission‑driven culture with teams across France, Spain, Belgium and Canada.
• Competitive compensation and benefits package.