Security Engineer – GRC

About This Opportunity

Our talent team is representing a confidential health technology organization operating across multiple European markets. This Security Engineer – GRC role sits at the intersection of regulatory compliance, risk management, and technical security in a highly regulated environment. The organization handles sensitive health data under strict regulatory frameworks including ISO 27001, DORA, HDS, and NIS2, serving over one million members across France, Belgium, and Spain.

This is a senior-level position with direct board exposure and genuine ownership of the security governance program. You'll partner closely with Legal, Internal Audit, Risk, and Engineering teams to build scalable compliance infrastructure that supports rapid growth in regulated markets.

Responsibilities

• Own and operate the ISO 27001 Information Security Management System, including scope definition, internal audit programmes, and management reviews through full certification cycles
• Serve as the technical security expert on regulatory matters, translating DORA, HDS, RGPD, PGSSI-S, and NIS2 requirements into operational controls and implementation plans
• Lead security risk cartography using EBIOS RM methodology, facilitating workshops and producing treatment plans that integrate with enterprise risk frameworks
• Define and maintain the controls framework while distributing control ownership to Infrastructure, Platform, and Engineering teams
• Manage audit cycles in partnership with Internal Audit and external certification bodies, ensuring coherent control effectiveness reporting to the board
• Run vendor security assessments and define contractual security requirements including security annexes and data processing agreements
• Own ICT incident governance, classify and escalate incidents, and provide security substance for DORA incident reporting
• Automate compliance evidence collection through scripted pipelines integrated with engineering systems
• Configure and administer GRC platforms, designing workflows and dashboards that serve multiple stakeholder teams
• Review architectural proposals to identify control gaps in identity, network segmentation, encryption, and logging

What We're Looking For

• Proven experience leading at least one full ISO 27001 certification or recertification cycle as the accountable ISMS owner
• Deep understanding of French/EU health sector regulatory frameworks including ANS, CERT Santé, HDS qualification requirements, and sensitive health data handling
• Hands-on experience with EBIOS RM risk assessment methodology and integration with enterprise risk programmes
• Track record managing complex multi-regulator compliance across DORA, NIS2, RGPD, and sector-specific health regulations
• Technical capability to automate compliance work using Python or similar scripting, and experience administering GRC platforms (CISO Assistant, ServiceNow GRC, or similar)
• Strong understanding of cloud security governance, shared responsibility models in regulated environments, and policy-as-code approaches
• Experience working collaboratively with Legal, DPO, Internal Audit, and Engineering teams to align security requirements without creating blockers
• Ability to translate technical risk into business language for board and executive audiences
• Experience managing vendor security assessments and third-party risk programmes
• Fluency in French and English required given the regulatory environment and stakeholder base
• Legal eligibility to work in France, Belgium, or Spain

How We Work With You

When you apply through Get A Job.ai, our experienced recruiters conduct an initial screening to understand your background, confirm your qualifications, and discuss the opportunity in detail. We then submit qualified candidates directly to our client for consideration. Throughout the process, we serve as your advocate and primary point of contact.

Important: Please do not attempt to contact the client organization directly. All applications and communications must go through Get A Job.ai to be considered for this confidential search.

Pay

This role is based in France with remote flexibility. Compensation details will be discussed during the screening process with our recruiting team.

Equal Opportunity: Get A Job.ai is committed to providing equal employment opportunities to all qualified applicants regardless of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or veteran status. We encourage applications from candidates of all backgrounds.