Security & Compliance Engineer – GRC & Product Security – Security and IT Team

Job description

About Scality Scality solves organisations' biggest data storage challenges: growth, security, performance, and cost. Designed for end-to-end cyber resilience, only Scality S3 object storage with CORE5 safeguards data at every level of the system, from API to architecture. Its patented MultiScale Architecture enables limitless, independent scalability in all critical dimensions to meet the unpredictable demands of modern workloads. The world's most discerning companies depend on Scality to accelerate high-performance AI initiatives, optimize cloud deployments, and defend their data with confidence. Recognized as a leader by Gartner, Scality software is reliable, secure, and sustainable. The job context The team Our IT & Security team builds, runs and secures Scality's IT infrastructure. It also supports the whole Scality community: employees, contractors, consultants and freelancers. We make sure everyone works in a secure, compliant and up-to-date environment. We also bring security expertise to our products (RING, ARTESCA, ADI) and to our customers. You will join a team of 4 to 5 people with varied backgrounds (development, security, IT operations, helpdesk) and 2 to 30+ years of experience. The mission You will own Scality's information security compliance program and coordinate the team's security operations. You will lead our ISO 27001 and ISO 42001 (AI management system) certifications and manage vulnerability (CVE) follow-up with Engineering. You will answer customer security requests and audits. You will also help our products meet new regulations such as the EU Cyber Resilience Act (CRA). The role is about 70% governance, risk and compliance (GRC) and product security, and 30% hands-on security operations. The job description You will own (Responsible) Security operations coordination : be the point of contact for incoming IT & Security requests, prioritize them and dispatch them within the team. Vulnerability management : Assess product exposure to CVEs by leveraging internal tools powered by our Software Bills of Materials (SBOMs).. Handle customer security requests (RD tickets) with Engineering and Support until a fix version or a customer answer is delivered. Track scan and pentest reports through remediation. ISO 27001 and ISO 42001 programs : maintain the framework, policies and procedures in our GRC tool. Run risk analysis and treatment plan…