Security & Compliance Engineer

BuyCo digitalizes and simplifies container shipping operations with a motto: “Shipping made easy!” Most of the things around you (your phone, your clothes, your coffee) crossed an ocean in a shipping container. Behind each of those containers, a company has to book space on a ship, coordinate carriers, freight forwarders and customs agents, and keep track of dozens of documents, often still by email, phone and spreadsheet. That's where we come in. Our collaborative SaaS platform gives importers and exporters a single place to:

Job Description

We are recruiting a Security & Compliance Engineer.

What you will do on a daily basis:

Core tasks:

Platform security

• Secure the BuyCo platform by applying and promoting best practices across our infrastructure: AWS, Azure, data tools and Kubernetes.
• Act as BuyCo's pentest referent: work with pentesters, understand their findings and recommendations, and drive remediation with the engineering teams.
• Prioritize security topics based on risks, so the main risks are always covered.
• Spread a strong security culture: explain security choices in simple words and bring teams on board.

Security operations (run & build)

• Monitor, maintain and improve BuyCo's security stack: check alerts every day, triage and categorize them, and create tickets for the right teams.
• Improve our security tooling over time, and contribute to the choice of new tools and service providers.
• Manage access across the company: onboarding, offboarding and access levels.

Compliance & governance

• Maintain and improve our ISO 27001 certification and our SOC 2 certification (to obtain or maintain, depending on your start date), with the support of Drata.
• Write, update and improve our security policies, rules and processes.
• Prepare internal audits (at least once a year, ideally twice).
• Handle GDPR topics and their international equivalents (e.g. LATAM, Australia), and prepare BuyCo for the EU AI Act.
• Answer our customers' security questionnaires.

Your path at BuyCo:

• 4 months after your arrival: you have a good grasp of the whole BuyCo platform: our infrastructure, Disaster Recovery Plan, SLAs and ISO 27001 framework. You can answer a customer's security questionnaire on your own.
• 8 months after your arrival: you have run a gap analysis between where we are and where we want to be, and built BuyCo's security roadmap. The hot topics (platform, development, tools, processes) are identified to get and stay compliant.
• 1 year after your arrival: your impact on security and compliance is concrete and visible. Our certifications are ready for renewal, internal audits show no non-conformities, and BuyCo has clear governance on data, AI and GDPR risks.

Preferred Experience

If you recognize yourself in this, you have a great chance of succeeding in the position:

• You have solid experience in cybersecurity and can work autonomously from day one on security topics.
• You speak English and French, and are comfortable working with vendors and customers in English.
• You have a strong tech background: you understand infrastructure and software engineering fundamentals, and you can talk with developers in their own language.
• You have hands-on experience with public Cloud (AWS preferred) and Kubernetes.
• You have already taken part in a certification process (ISO 27001, SOC 2 or any other). You don't need to be a compliance expert: you are eager to grow on this side.
• You know how to prioritize based on risk: you know nothing is infallible, and you focus on what matters most.
• You anticipate problems instead of waiting for them.
• You are a good teacher and tenacious: you can explain tricky security topics in simple words and bring people on board.
• You are curious and keep up with new topics, such as AI and its security challenges.

Your profile will be if:

• You have worked with Wiz or another Cloud security platform, and with Drata or another compliance automation tool.
• You have experience with Identity and Access Management, ideally Keycloak.
• You know GDPR well and have followed the EU AI Act closely.
• You have worked in a B2B SaaS company.

Compensation, Remote Policy & Others

(Only with a French contract)

• Compensation: between 52k€ and 64k€ gross per year
• No on-call duty (pas d'astreintes)
• Type of contract: Permanent contract (CDI)
• Ideal start date: January 2027
• Participation in purchasing remote items
• Remote policy: full remote possible. As a reminder, we have offices in Paris & Marseille (HQ).

• Swile meal vouchers
• SideCare health insurance
• 50% reimbursement of public transportation costs
• Sustainable mobility bonus
• Profit-sharing bonus
• Holiday bonus
• Choice of your equipment: Lenovo or Mac
• 6 additional RTT days per year
• 2 paid sick child leave days

Recruitment process

• Step 1: interview with Cyril, Talent Acquisition Manager (45min)
• Step 2: interview with Joffrey, Head of Platform, and Mickaël, CTPO, with a deep dive into your security and compliance expertise (1h30)
• Step 3: Culture fit interview with Annie, VP People, and possibly Christophe, Head of Engineering (1h)