Governance, Risk & Compliance Specialist

À propos du poste

🧡 About Alma

At Alma, we believe sustainable commerce depends on fair, well‑balanced trade. Because finance plays a pivotal role in business, our mission is to put it back in its rightful place - serving merchants and consumers.

Our installment and deferred payment solutions help merchants boost sales by 20% or more, increase customer loyalty, and deliver a seamless shopping experience - without encouraging bad debt.

As the buy now pay later leader in France and active in 10 European countries, we've empowered over +25,000 merchants and 10 million consumers.

With 380+ Almakers and €100M+ ARR, Alma is scaling rapidly across Europe as a member of the Next40, and we're just getting started!

👐 About the team

Alma is a licensed payment institution (ACPR-approved), processing millions of transactions across France and Europe. The regulatory environment has materially tightened: DORA entered into force in January 2025, NIS 2 is now transposed in France, and ACPR oversight is intensifying. To meet this moment, Barbara, our Head of IT & Security is actively building and structuring the IT & Security function. The team currently counts 6 people, with profiles covering infrastructure, security operations, and IT.

This position is permanent role (CDI) based in Paris.

💼 About the job

Regulatory compliance: DORA, NIS 2 & ACPR

•
Build Alma's DORA and NIS 2 compliance roadmap: conduct gap analysis, define remediation priorities, and track execution

•
Coordinate cross-functional requirements with Finance, Legal, and Engineering to maintain a consistent regulatory posture

Security risk mapping

•
Own and maintain the Security Risk Map (Risk Map 2026): expand its cyber/InfoSec coverage and enrich risk scoring

•
Connect risk findings to structured remediation plans and report progress to the CISO on a regular cadence

Security policies & audit readiness

•
Formalize, update, and enforce security policies and procedures across the organization

•
Lead evidence collection and audit response for external reviews (ACPR inspections, SOC 2 Type II, ISO 27001 roadmap)

Security governance & cross-functional bridge

•
Translate regulatory requirements into actionable plans for both technical teams (Engineering, SRE) and business stakeholders (Legal, Compliance, Executive)

•
Structure and maintain Alma's security governance framework: contracts, technical clauses, internal security awareness