Governance, Risk & Compliance Specialist

À propos du poste

<h3><strong>🧡 About Alma</strong></h3> <p>At Alma, we believe sustainable commerce depends on fair, well‑balanced trade. Because finance plays a pivotal role in business, our mission is to put it back in its rightful place - serving merchants and consumers.</p> <p>Our installment and deferred payment solutions help merchants boost sales by 20% or more, increase customer loyalty, and deliver a seamless shopping experience - without encouraging bad debt.</p> <p>As the buy now pay later leader in France and active in 10 European countries, we've empowered over +25,000 merchants and 10 million consumers.</p> <p>With 380+ Almakers and €100M+ ARR, Alma is scaling rapidly across Europe as a member of the Next40, and we're just getting started!</p> <p> </p> <h3><span class="notion-enable-hover" data-token-index="0">👐 About the team </span></h3> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0">Alma is a licensed payment institution (ACPR-approved), processing millions of transactions across France and Europe. The regulatory environment has materially tightened: DORA entered into force in January 2025, NIS 2 is now transposed in France, and ACPR oversight is intensifying. To meet this moment, <a href="https://www.linkedin.com/in/dacostabarbara/">Barbara</a>, our Head of IT & Security is actively building and structuring the IT & Security function. The team currently counts 6 people, with profiles covering infrastructure, security operations, and IT.</p> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0"><strong><span class="notion-enable-hover" data-token-index="0">This position is permanent role (CDI) based in Paris</span></strong><strong><span class="notion-enable-hover" data-token-index="0">. </span></strong></p> <h3 class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0" data-pm-slice="0 0 []"> </h3> <h3 class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0" data-pm-slice="0 0 []"><span class="notion-enable-hover" data-token-index="0">💼 About the job</span></h3> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0"><strong>Regulatory compliance: DORA, NIS 2 & ACPR</strong></p> <ul class="s-list-disc s-pb-2 s-pl-6 s-flex s-flex-col s-gap-1"> <li class="s-break-words"> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0">Build Alma's DORA and NIS 2 compliance roadmap: conduct gap analysis, define remediation priorities, and track execution</p> </li> <li class="s-break-words"> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0">Coordinate cross-functional requirements with Finance, Legal, and Engineering to maintain a consistent regulatory posture</p> </li> </ul> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0"><strong>Security risk mapping</strong></p> <ul class="s-list-disc s-pb-2 s-pl-6 s-flex s-flex-col s-gap-1"> <li class="s-break-words"> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0">Own and maintain the Security Risk Map (Risk Map 2026): expand its cyber/InfoSec coverage and enrich risk scoring</p> </li> <li class="s-break-words"> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0">Connect risk findings to structured remediation plans and report progress to the CISO on a regular cadence</p> </li> </ul> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0"><strong>Security policies & audit readiness</strong></p> <ul class="s-list-disc s-pb-2 s-pl-6 s-flex s-flex-col s-gap-1"> <li class="s-break-words"> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0">Formalize, update, and enforce security policies and procedures across the organization</p> </li> <li class="s-break-words"> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0">Lead evidence collection and audit response for external reviews (ACPR inspections, SOC 2 Type II, ISO 27001 roadmap)</p> </li> </ul> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0"><strong>Security governance & cross-functional bridge</strong></p> <ul class="s-list-disc s-pb-2 s-pl-6 s-flex s-flex-col s-gap-1"> <li class="s-break-words"> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0">Translate regulatory requirements into actionable plans for both technical teams (Engineering, SRE) and business stakeholders (Legal, Compliance, Executive)</p> </li> <li class="s-break-words"> <p class="s-whitespace-pre-wrap s-break-words s-font-normal first:s-pt-0 last:s-pb-0">Structure and maintain Alma's security governance framework: contracts, technical clauses, internal security awareness</p> </li> </ul> <p class="s-whitespace-pre-wrap…