GRC Security Engineer (Ideally hybrid Paris or remote)

Project overview

Context

You will join a fintech company in the banking sector, a subsidiary of a large French banking group, to manage security governance, risk, and compliance (GRC) on a daily basis. Your scope covers ISO 27001 ISMS, the security requirements of our Approved Platform status, and the security requirements of the banking group.

You will report to the CISO, who sets the direction and remains responsible for security to management. The DevSecOps team operates the technical controls; you will define the framework, monitor its implementation, and provide evidence. GDPR is managed by our DPO, with whom you will collaborate on common topics.

You will have a great deal of autonomy. Many governance processes still need to be created: we expect you to propose them, build them, and get them adopted. You will report to the CISO on matters requiring arbitration.

Missions

The missions below set the direction, not a fixed list. We are counting on you to identify gaps, propose solutions adapted to our size, and implement them end-to-end.

What you will build

Your contacts

The CISO, management, the CTO, the DevSecOps team, the DPO, the certification body, and the internal auditor.

Why this position is unique

• Maintain the ISO 27001 ISMS. You will keep the scope, the ISMS Plan, and the Statement of Applicability up-to-date. You will prepare for the management review and security topics for the TRM Committee, and follow up on corrective actions until their closure.
• Lead audits. You will prepare certification and surveillance audits with the certification body, and coordinate the internal audit program conducted by an external auditor. You will know what deteriorates between audits and how to prevent it.
• Manage controls in Drata. Drata is our reference tool for controls. You will maintain the repository, assign each control to its owner, monitor automated tests and evidence, and manage the remediation of deviations.
• Maintain the documentation corpus. You will maintain security policies and procedures: drafting, approval process, periodic review, awareness for employees and service providers.
• Drive risk management. You will maintain the risk map using the EBIOS RM method, lead workshops with the teams, and monitor treatment plans. You will know how to recognize when a security risk is actually a business risk.
• Ensure Approved Platform compliance. You will maintain the security aspect of our Approved Platform status with the DGFiP: requirements from the specifications, proof of compliance, preparation/monitoring of audits related to the approval.
• Monitor control effectiveness. You will define ISMS indicators and monitor them with the technical teams: vulnerability remediation times, access reviews, workstation updates, lessons learned after incidents.
• A certification at the right level. Our ISMS is expanding to explicitly cover the Approved Platform, and we are moving to a COFRAC-accredited certification body. You will lead the preparation for this certification and its ongoing maintenance.
• A unified control base in Drata. ISO 27001, Approved Platform requirements, and banking group requirements: a single, shared set of controls, to grow without rebuilding compliance for each new requirement.
• Continuously collected evidence. You will connect Drata to our systems to replace manual collection. Auditing will become a continuous capability, not a last-minute sprint.
• Direct impact. Your work conditions our certification, our Approved Platform status, and the trust of the banking group and our clients.
• New territory. The electronic invoicing reform is rolling out and places us at the heart of a brand-new regulated system. Few companies our size combine these challenges: you will build solutions that do not yet exist off-the-shelf.
• Real autonomy. Within a team of about forty people, you are a key player in security and compliance.

Project details

• Start: flexible
• Remote: hybrid
• Location: Paris, France, FR
• Rate: 81-81 EUR/h
• Languages: French