Head of Security Governance, Alan
Deputy CISO, GRC Lead
€83-116k
+ Equity
Python
ServiceNow
Senior and Expert level
Paris
Digital healthcare insurance
Be an early applicant
Digital healthcare insurance
1001+ employees
HealthcareB2CB2BInsuranceSaaSMobile
Be an early applicant
€83-116k
+ Equity
Python
ServiceNow
Senior and Expert level
Paris
1001+ employees
HealthcareB2CB2BInsuranceSaaSMobile
Company mission
To make the healthcare system frictionless, fair and friendly for everyone.
Role
Who you are
- You translate risk into business language. You can brief a board or an audit committee and make them feel informed — not overwhelmed or underwhelmed. You know the difference between a finding that requires an emergency board call and one that belongs in a quarterly report
- You influence without authority. You align Legal, DPO, Risk, Engineering, Product, and Operations on security requirements without creating blockers or adversarial dynamics. People don't avoid you — they come to you early because you make their lives easier, not harder
- You manage programmes with audit-grade rigor. You run structured, traceable roadmaps. You know where every commitment is, who owns it, and when it's due. You escalate proactively and don't let dependencies surprise you
- You build security culture, not compliance theatre. Your awareness programmes land because they're relevant, not because they're mandatory. You foster proportionate risk ownership across the company — the goal is teams making better decisions, not teams checking boxes
- You think in principles when frameworks shift. DORA is live. NIS2 transposition pace varies. The AI Act is arriving. You don't freeze when the regulatory landscape moves — you reason from first principles and adapt without waiting to be told what to do
- We hire people, not checklists. If you're excited by this scope but don't check every box, we'd still love to hear from you
What the job involves
- Alan operates at the intersection of health insurance, prevention, and regulated data. The person in this role owns the security governance and risk posture of a company that handles sensitive health data for 1M+ members, operates under DORA and HDS certification requirements, and is regulated by the ACPR
- They work in close partnership with Legal, Internal Audit, and the broader Risk function — this is a collaborative role, not a siloed one
- Own and operate the ISO 27001 ISMS. You are the accountable owner of the Information Security Management System — scope definition, Statement of Applicability, internal audit programme, and management review. You've led at least one full certification or recertification cycle and know what breaks down in the months between audits
- Be the security expert in the room on regulatory and privacy matters — not the owner. Legal leads on DORA, HDS, RGPD, PGSSI-S, and regulatory relationships. Your role is to bring the technical and operational security substance: translating regulatory requirements into controls, flagging implementation gaps, and making sure the security programme holds up when the regulatory team negotiates with the ACPR or ANS
- Run risk as a living programme, in partnership with the broader risk function. You lead security risk cartography using EBIOS RM and ensure it feeds into — and is informed by — the company-wide risk framework. You facilitate risk workshops, produce treatment plans, and bring the security lens to forums where non-security risks are also on the table. You know when a security risk is actually a business risk in disguise
- Own the controls framework, but distribute ownership of controls themselves. You define the framework, set the standards, and track coverage — but the controls live with the teams who build and run the things they protect. You work closely with Infrastructure, Platform, and Engineering to ensure foundational building blocks (identity, network, secrets management, logging) are designed with security requirements embedded, not bolted on. You're a partner to those teams, not an auditor standing over them
- Run audit cycles with rigour, in close partnership with Internal Audit. You manage the security audit programme and coordinate with certification bodies, but you're not operating in a vacuum. You work with Internal Audit to align scopes, avoid duplication, and present a coherent picture of control effectiveness to the board. You've sat in joint audit planning sessions and know how to make that relationship productive rather than territorial
- Manage third-party risk with real teeth. You run vendor security assessments, define contractual security requirements (security annexes, DPAs). You partner with our Risk team, which oversees third-party risk, and own the security dimension
- Bring the health sector context. You understand the ANS framework, CERT Santé requirements, and what it means to handle sensitive health data operationally — not just on paper. You're a useful partner to Legal when the question is "what does this regulation actually require us to do technically?"
- Own incident governance and support DORA reporting. You classify and escalate ICT incidents internally, own BCP and DRP governance, and provide the security substance for DORA incident reports
- Next-Gen Compliance Framework: ISO 27001, DORA, HDS, NIS2 — multiple regulators, multiple countries, one coherent governance backbone. Build the system that lets Alan scale from 1M to many millions of members without rebuilding compliance every time
- Automated Audit & Evidence Engine: Replace manual evidence collection with scripted pipelines plugged directly into engineering systems. Turn audit cycles from quarterly fire drills into a continuous capability
- Living Risk Cartography: Risk treated as an operational signal, not a static deliverable. EBIOS RM at the core, feeding directly into business and engineering decisions
- You'll work closely with Legal, DPO, Internal Audit, and the broader Risk function — and partner day-to-day with Infrastructure, Platform, Engineering, Product, and Operations. You're the bridge between regulatory complexity and operational simplicity
- Direct Impact: You own the trust foundation that lets Alan handle health data for 1M+ members and operate in highly regulated markets. Your work is the precondition for everything else Alan does
- Complex Problems: 4 regulators across 4 countries, sensitive health data, and a regulatory landscape that keeps shifting (DORA, NIS2, AI Act) — to be modeled into a single, coherent control system
- Ownership & Growth: Board and executive exposure, real influence on company-wide risk decisions, and the autonomy to shape Alan's security culture across 800+ people
- Automate compliance work wherever possible. You script evidence collection, automate control testing, and connect GRC tooling to engineering pipelines. You've used Python or similar to reduce the manual lift of an audit cycle, and you actively look for the next process to streamline
- Configure and own GRC tooling, not just use it. You can administer platforms like CISO Assistant, ServiceNow GRC, or Archer — designing workflows, building dashboards, and making them actually useful for the teams that feed them data
- Speak cloud governance fluently. You understand shared responsibility in HDS-qualified environments, know what CSPM tools surface and what they miss, and can reason about policy-as-code (OPA, SCP) without needing an engineer to translate
- Read architecture well enough to challenge it. You can review a proposed architecture, identify control gaps in identity, network segmentation, encryption, or logging, and push back credibly in a room of engineers — without pretending to be one
- Interpret vulnerability data and drive prioritisation. You read scan outputs, work with engineering teams to prioritise remediation by business risk rather than CVSS score, and track resolution KPIs over time
Our take
Alan addresses health insurance for businesses and employees in Europe through a healthcare app, backed by official regulatory approval. This endorsement grants Alan the ability to offer a wide range of regulated healthcare insurance services, distinguishing itself in the market.
Focused on user experience and customer satisfaction, Alan employs a people-centric approach, streamlining insurance claims and designing user-friendly health insurance products. While competitors like Babylon and Ada Health exist, Alan's primary focus on health insurance sets it apart.
Despite macroeconomic challenges prompting a goal realignment, Alan achieved significant revenue growth in 2023 and reached a valuation of $4.5 billion in late 2024. This was driven by impressive funding rounds and an expansion of its client base, leveraging AI tools for enhanced productivity. With a robust cash revenue, Alan plans to sustain growth, consolidate its position in the existing markets, and explore expansion into new territories, positioning itself for a potential future IPO.
Freddie
Company Specialist at Welcome to the Jungle
Insights
Top investors
13% employee growth in 12 months
Company
Funding (last 2 of 8 rounds)
Mar 2026
$116.3m
LATE VC
Sep 2024
$201.2m
SERIES F
Total funding: $889.8m
Company benefits
- Fair rewards: Generous equity packages complement your base salary, for permanent contracts only
- Flexible Office: Amazing office space at our HQ, sponsored co-working hubs or a full-remote experience with home office equipment sponsorship, we want you to live where you’re the happiest
- All the tools you need: Top-of-the-range equipment: Macbook Pro, keyboard, laptop stand, monitor, and Bose noise-cancelling headphones
- Flexible vacation policy and flexible working hours: Organise your time as you wish
- Delightful healthcare insurance: Extremely comprehensive health insurance - 100% of the contribution covered by Alan for you and your family, for permanent contracts only
- Transport: Country-specific commuter benefits
- Learning & Training opportunities: A highly flexible Training policy free books and a budget to attend and speak at conferences if the opportunity arises
- Parental leave: Extended parental leave for all new parents, for permanent contracts only
Company HQ
Plaine-Monceau, Paris, France
Leadership
Charles Gorintin
(Co-Founder & CTO)Co-founding Advisor at Mistral AI. Previously a Data Scientist at Facebook, Instagram, and Twitter.
Jean-Charles Samuelian-Werve
(Co-Founder & CEO)Co-founding Advisor and Board Member at Mistral AI. Previously co-founded Expliseat.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 49 more jobs at Alan