SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Pennylane, a high-growth French fintech backed by Sequoia and other leading investors, is building Pennylane Financial Services (PFS), a newly created regulated subsidiary applying for ACPR authorizations as a payment institution and financing company. This is a foundational step to deliver comprehensive financial-services products to SMEs and accounting firms across Europe.
You will own PFS's security governance and overall security and resilience policy, reporting directly to the Chief Compliance and Risk Officer. Your role is to design a risk and control framework proportionate to PFS's activity and regulatory expectations, and to ensure the organization can evidence "security by design" through auditable, inspection-ready artifacts.
Key responsibilities include:
- Own PFS Information Security policy: define, maintain, and continuously improve PFS security governance, standards, and policy set.
- Manage the PFS risk and control framework: maintain the security risk taxonomy, control objectives, key risks/KRIs, escalation thresholds, and evidence expectations.
- Embed security-by-design into the Product/Tech development cycle: leverage Pennylane SAS policies where applicable, ensuring PFS security requirements and regulatory obligations are reflected in the delivery lifecycle, change process, and go/no-go decisions.
- Ensure operational resilience, continuity, and testing: define resilience requirements and ensure end-to-end testing and exercises produce usable evidence and tracked remediation.
- Manage outsourcing arrangements and audits: oversee security aspects of outsourcing arrangements (intragroup and third parties), ensure auditability, and follow through on findings and remediation.
- Provide executive-level reporting: deliver clear, decision-oriented reporting on information-security posture, incidents, resilience testing, and remediation to PFS management and the Supervisory Board.
You will track KPIs including policy & standards effectiveness, core security KRIs within risk appetite, resilience testing KPIs, incident classification & remediation tracking, audit follow-up tracking, and threat & vulnerability landscape monitoring.
During the probation period, you will establish the initial PFS security governance baseline (policy set, decision rights, reporting cadence), propose and align a first set of PFS security KRIs and risk appetite thresholds, produce a first resilience testing plan, and put in place an incident classification approach and remediation tracking routine that is audit-ready.
Pennylane is a fintech at the forefront of growth in France with 1,200+ employees across 25 countries, 1.5M+ SME/TPE users, and 7,000+ accounting firms using the platform. The company offers a flexible remote-first culture, strong benefits (Alan health insurance, Swile meal vouchers, 6-12 additional RTT days, coworking budget, BSPCE options, Gymlib wellness access), and regular in-person events including quarterly Tech Days and an annual company seminar.
REQUIREMENTS:
Must-have:
- Fintech and/or banking experience
- Strong experience in information security, technology risk, cyber-risk, or security assurance, with ownership of complex topics
- Proven ability to design and run security governance and a risk/control framework with audit-ready evidence
- Experience working with outsourced/third-party/group-shared technology services while retaining accountability
- Strong stakeholder management and communication skills, including executive-level reporting
- Professional fluency in French and English
Nice-to-have:
- Operational resilience experience, including DORA-aligned practices (incident management, continuity, testing, third-party oversight)
- Knowledge of payment and authentication topics (SCA, strong authentication, account recovery patterns)
- Exposure to PCI DSS scope and payment-card security concepts
- Payment fraud and transaction-monitoring familiarity (fraud patterns, controls, investigations, collaboration with Fraud/AML stakeholders)
