Security Governance & GRC Lead

About the role

Alan is building a new standard in prevention insurance and needs a senior professional to own its security governance and risk posture. The role is responsible for the Information Security Management System (ISMS) and for translating regulatory requirements into actionable security controls.

Key responsibilities

• Own and operate the ISO 27001 ISMS, including scope definition, Statement of Applicability, internal audit programme and management review.
• Lead security risk mapping using EBIOS RM and integrate findings into the company‑wide risk framework.
• Collaborate with Legal, Internal Audit and the broader Risk function to translate DORA, HDS, GDPR and other regulatory requirements into technical controls.
• Facilitate risk workshops, produce treatment plans and ensure security risks are correctly classified as business risks when appropriate.
• Define the controls framework, set standards and monitor coverage while delegating control ownership to product and operations teams.

Required profile

• Proven experience leading at least one full ISO 27001 certification or recertification cycle.
• Strong understanding of French and European health‑data regulations (DORA, HDS, GDPR, PGSSI‑S).
• Ability to work collaboratively across legal, audit and risk functions.
• Excellent communication skills to convey security concepts to non‑technical stakeholders.

Required skills

• ISO 27001 implementation and management
• Information Security Management System (ISMS)
• EBIOS RM risk assessment methodology
• Regulatory compliance (DORA, HDS, GDPR, PGSSI‑S)
• Security risk management and treatment planning