Security Officer Senior - GRC

Role overview Set the direction for security governance and risk across a growing, regulated organization handling sensitive health information. You’ll build a framework that helps teams prioritize and manage real risks across certifications and regulations, while also shaping governance for AI use. This is a hands-on senior role that includes mentoring a junior GRC engineer and helping grow the function.

Responsibilities - Own the security framework and certification cycles, including ISO 27001, HDS, and future standards, making controls useful in day-to-day decisions. - Explain the security implications of regulatory requirements and define practical controls in partnership with Legal and Risk. - Run risk management as an ongoing process, helping teams identify, prioritize, and address material risks. - Develop governance for AI use across products and operations, including risk assessment and appropriate controls. - Work with the Data Protection Officer, Internal Audit, Risk, engineering, and operations teams. - Mentor a junior GRC engineer and help shape the team’s future approach.

Requirements - At least six years of security experience, including substantive GRC ownership. - Experience leading a GRC roadmap in a certified or strongly regulated environment, such as one using ISO 27001, HDS, or SOC 2. - Confidence working with certification auditors and explaining framework requirements in terms business teams can apply. - Sound judgment on risk, with a focus on reducing meaningful exposure through practical action. - Fluent French and English.

Nice to have - Personally led a certification or audit cycle end to end. - Automated compliance work or developed a considered view of where AI can help. - Presented risk to senior leaders or a board, or mentored and onboarded colleagues.

Benefits and work setup - Permanent employment; candidates must be legally eligible to work from France, Belgium, or Spain. - Remote-work flexibility is available.