SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Alan is a prevention-focused health insurance company serving 1M+ members across Europe and Canada, with €800M+ ARR. The company integrates insurance, prevention, and care into a single platform and recently earned HDS certification.
You will own security governance and risk end-to-end, establishing a unified framework across certifications and regulations (ISO 27001, HDS, and future standards) that the entire company uses to prioritize security decisions. This is a hands-on senior role where you will both execute the work yourself and mentor a junior GRC engineer being hired alongside you.
Key responsibilities:
- Own the full certification cycle and transform compliance frameworks into practical tools teams use daily, not just audit binders
- Bring the security perspective on regulatory requirements, translating rules into data protection controls and practical implementation
- Run an ongoing risk management program: map and prioritize security risks (including AI risks), develop treatment plans, and feed findings into company-wide risk decisions
- Define controls frameworks and standards while enabling engineering and operations teams to own their controls; brief the board and audit committee on findings
- Own incident governance, including triage, escalation, business continuity, disaster recovery, and regulatory incident reporting
- Partner credibly with engineering teams early in design cycles to identify control gaps (access, encryption, logging) before deployment
You will build: a unified governance model with clear risk and control ownership; a living, prioritized risk map that drives company decisions; a scalable compliance backbone across countries and regulators; and an automated evidence engine that enables continuous auditing.
You will work closely with Legal, the Data Protection Officer, Internal Audit, Risk, and day-to-day with engineering and operations teams.
REQUIREMENTS:
- 6+ years in security with real GRC ownership
- Proven experience running a GRC roadmap in a certified or strongly regulated environment (ISO 27001, HDS, SOC 2, or regulated sectors such as health, insurance, or finance)
- Comfort working with certification auditors and ability to explain framework requirements and business rationale to teams
- Strong risk judgment; preference for closing real risks over writing policies
- Fluency in both French and English
BIG PLUS:
- End-to-end certification or audit cycle ownership
- Experience automating compliance work or eagerness to do so, with perspective on AI applications
- Experience presenting risk to senior leaders or boards
- Prior mentoring or onboarding experience
