Security Engineer

📋 Job Overview

Health can’t wait. Not for symptoms to get worse. Not for a six‑month appointment. Not for a system to catch up. But that’s exactly how healthcare works today. You wait, until you can’t. Alan exists to end the wait. Health is a universal right, and we believe this right can only become real when it’s coupled with prevention. We need to stop treating health as something we repair and start treating it as something we build, every day. It’s not solely a question of willpower. It’s the healthcare system itself that needs to work for everyone, in a sustainable way. So we are building the new standard in prevention insurance. Alan is the first company that integrates insurance, prevention, and care into a single, acclaimed user experience. We are on an incredible journey to build a global leading company, with a unique culture. We already partner with 40K+ companies of all sizes, serving more than 1M+ members, and have reached €800M+ in ARR. Prevention as the new norm. That's what we're building with our team of 800+ people. If it speaks to you: we're hiring across France, Spain, Belgium, and Canada. And beyond. Alan operates at the intersection of health insurance, prevention, and regulated data. The person in this role owns the security governance and risk posture of a company that handles sensitive health data for 1M+ members, operates under DORA and HDS certification requirements, and is regulated by the ACPR. They work in close partnership with Legal, Internal Audit, and the broader Risk function. It's a highly collaborative role.

🏢 About Alan

Alan exists to end the wait in healthcare. We believe health is a universal right, and this right can only become real when coupled with prevention. We are building the new standard in prevention insurance by integrating insurance, prevention, and care into a single, acclaimed user experience. With over 40K+ companies as partners, serving more than 1M+ members, and reaching €800M+ in ARR, we are on an incredible journey to build a global leading company with a unique culture. Our team of 800+ people is dedicated to making prevention the new norm.

🎯 The Role

You will be responsible for owning and operating the ISO 27001 ISMS, acting as the security expert on regulatory and privacy matters, running risk as an ongoing program, owning the controls framework, running audit cycles with rigor, managing third-party risk, bringing the health sector context, and owning incident governance and supporting DORA reporting. You will work closely with Legal, DPO, Internal Audit, and the broader Risk function, and partner day-to-day with Infrastructure, Platform, Engineering, Product, and Operations.

✅ Key Responsibilities

• Own and operate the ISO 27001 ISMS, including scope definition, Statement of Applicability, internal audit program, and management review.
• Be the security expert on regulatory and privacy matters, translating regulatory requirements into controls and ensuring the security program is solid.
• Run risk as an ongoing program, leading security risk cartography using EBIOS RM and ensuring it feeds into the company-wide risk framework.
• Own the controls framework, defining standards and tracking coverage while distributing ownership of controls to the teams that build and run the things they protect.
• Run audit cycles with rigor, managing the security audit program and coordinating with certification bodies.
• Manage third-party risk, running vendor security assessments and defining contractual security requirements.
• Bring the health sector context, understanding the ANS framework, CERT Santé requirements, and what it means to handle sensitive health data in day-to-day operations.
• Own incident governance and support DORA reporting, classifying and escalating ICT incidents internally and providing the security substance for DORA incident reports.

🎁 Benefits

At Alan, we offer an attractive Equity package on top of an above market-average base salary. The salary range for this position is €83K – €100K. We believe in rewarding our employees with competitive compensation and benefits that support their well-being and professional growth.