Security Analyst (GRC Specialist)

Key Responsibilities

• Strategic Leadership


• Under the coordination of the CISO, participate in the definition of a multi-year, risk-driven security roadmap, design policies, processes and guidance documents driving its implementation


• Implementing the security roadmap, either autonomously or with support from other engineering teams, either in a delivery or project management capacity, depending on the project’s technical requirements.


• Establish and implement company-wide security policies and procedures covering internal IT, production platforms, facilities, and more.


• Improve and maintain the risk analysis and its mitigation planDesign and implement a comprehensive reporting framework of security indicators


• Operational Excellence


• Drive implementation of the security roadmap, leading initiatives and coordinating with engineering teams or other relevant stakeholders (legal, HR, support, customer experience


• Oversee vulnerability remediation, including triage, prioritization, and mitigation follow up.


• Oversee vendor security assessments and ensure alignment with compliance requirements, deliver security approvals in the procurement process


• Participate in the asset management program (contractors, accounts, datasets, etc.) 


• Compliance Management


• Lead certifications renewals for SOC 1, SOC 2, and contribute to acquisition of new certification (e.g., ISO 27001, ISO 27701)


• Lead planning and execution of compliance audit programs conducted both internally and externally.


• Maintain and enhance compliance programs, collaborating cross-functionally to ensure adherence.


• Coordinate with the Sales and Legal teams to understand the legislative landscape and market requirements in terms of compliance.


• Advocacy and Training


• Design and implement security awareness training programs and champion best practices across teams (onboarding training, awareness training, phishing simulations, developer trainings)

Experience & Expertise

• At least 5 years of experience on governance and compliance topics, either as Security Engineer, Security Project Manager, or compliance officer (of course, you can be way more experienced!)


• Extensive knowledge and experience with the ISO27000 series standard:  implementation experience in obtaining and maintaining is a plusSolid technical background in security engineering


• Great team spirit with a problem-solving, can-do attitude.


• Good dose of humility and the willingness to grow (no matter your seniority!).


• Fluent in English (French is not mandatory!).

Environment

• The scope of this role includes both the production environment and internal IT
• Sites in Paris, London, Toronto and NYC 
• MacOS, Windows, Linux
• GCP, Kubernetes, Terraform, Postgres, SingleStore, Vault
• Okta, Oauth, JWT, C#, .NET Core, TypeScript, React
•  Vanta (GRC), Riot (awareness), Google Workspace (office), Jumpcloud (MDM and SSO), Hibob (HRIS), Slack (IM), GitHub (VCS), CircleCI / ArgoCD (CI/CD) HackerOne (Bug Bounty program), Datadog (SIEM), 1Password (password manager)