Additional Information
1. About Alma
At Alma, we believe sustainable commerce depends on fair, well‑balanced trade. Because finance plays a pivotal role in business, our mission is to put it back in its rightful place - serving merchants and consumers.
Our installment and deferred payment solutions help merchants boost sales by 20% or more, increase customer loyalty, and deliver a seamless shopping experience - without encouraging bad debt.
As the buy now pay later leader in France and active in 10 European countries, we've empowered over +24,000 merchants and 9 million consumers.
With 380+ Almakers and €100M+ ARR, Alma is scaling rapidly across Europe-and we're just getting started.
Alma is the company for you if are looking for:
Collective intelligence is the driving force behind Alma: we are looking for open-minded, curious, and ambitious people who want to actively participate in this exponential growth.
To continue to deliver an optimal purchasing experience and absolute ease of use, all teams at Alma (Tech, Product, Sales, Operations, Data, Risk, Finance, Compliance, Legal, Marketing and People) will strengthen their members to maintain the highest standards of quality and trust while pushing these innovations at Alma's pace.
2. About the job
Alma is a licensed payment institution (ACPR-approved), processing millions of transactions across France and Europe. The regulatory environment has materially tightened: DORA entered into force in January 2025, NIS 2 is now transposed in France, and ACPR oversight is intensifying. To meet this moment, Barbara Goubert joined Alma in early 2026 as Head of IT & Security / CISO, and is actively building and structuring the IT & Security function. The team currently counts 6 people, with profiles covering infrastructure, security operations, and IT. This role is a genuine opportunity to build something meaningful. We're looking for a confirmed GRC Specialist to own and drive Alma's information security governance, risk management, and compliance program. If you have solid GRC foundations and are looking for an environment where your work has real impact and where you'll be supported to grow, we'd love to hear from you.
3. Your responsibilities and missions
Regulatory compliance: DORA, NIS 2 & ACPR
Build Alma's DORA and NIS 2 compliance roadmap: conduct gap analysis, define remediation priorities, and track execution
Coordinate cross-functional requirements with Finance, Legal, and Engineering to maintain a consistent regulatory posture
Security risk mapping
Own and maintain the Security Risk Map (Risk Map 2026): expand its cyber/InfoSec coverage and enrich risk scoring
Connect risk findings to structured remediation plans and report progress to the CISO on a regular cadence
Security policies & audit readiness
Formalize, update, and enforce security policies and procedures across the organization
Lead evidence collection and audit response for external reviews (ACPR inspections, SOC 2 Type II, ISO 27001 roadmap)
Security governance & cross-functional bridge
Translate regulatory requirements into actionable plans for both technical teams (Engineering, SRE) and business stakeholders (Legal, Compliance, Executive)
Structure and maintain Alma's security governance framework: contracts, technical clauses, internal security awareness
4. Our stack Slack - Vanta - Linear - Notion - Google Suite - Dust.
5. About you We're looking for someone with solid GRC foundations and the ability to make an impact in a cross-functional, fast-moving environment. You don't need to have done everything - but you're ready to take ownership, learn continuously, and bring people along with you.
Alma31 · Paris, France