> Markdown version of [/jobs/ext/4054338-ciso](https://www.wearedevelopers.com/jobs/ext/4054338-ciso). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # CISO - **Company:** Pennylane - **Location:** Paris, France (Remote available) - **Contract:** Permanent contract - **Skills:** Cyber Security, Financial Information EXchange, PCI Data Security Standards, SAS (Software) - **Published:** October 16, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=f44d86a9764e28fc ## About the Role * Fintech and/or Banking experience * Strong experience in information security, technology risk, cyber-risk or security assurance, with ownership of complex topics. * Proven ability to design and run security governance and a risk/control framework with audit-ready evidence. * Experience working with outsourced / third-party / group-shared technology services while retaining accountability. * Strong stakeholder management and communication skills, including executive-level reporting. * Professional fluency in French and English. Nice to have * Operational resilience experience, including DORA-aligned practices (incident management, continuity, testing, third-party oversight). * Knowledge of payment and authentication topics (SCA, strong authentication and account recovery patterns). * Exposure to PCI DSS scope and payment-card security concepts. * Payment fraud and transaction-monitoring familiarity (fraud patterns, controls, investigations, and collaboration with Fraud/AML stakeholders). ## Description Notre ambition est de devenir le logiciel de pilotage financier préféré des PMEs européennes. Nous aidons les entrepreneurs à se débarrasser des tâches chronophages liées à la comptabilité et à la finance, tout en leur donnant accès à des informations financières clés pour les aider à prendre les meilleures décisions pour leur entreprise. Parallèlement, nous aidons les cabinets d'expertise-comptable, en leur permettant de passer moins de temps sur des tâches redondantes et répétitives, et plus de temps sur la partie conseil et accompagnement de leurs clients., You will own PFS's security governance and overall security and resilience policy, under the direct supervision of the Chief Compliance and Risk Officer. Your contribution is to design a risk and control framework that is proportionate to PFS's activity and regulatory expectations, and to ensure PFS can evidence "security by design" through auditable, inspection-ready artefacts. In practice, this includes: * Policy alignment: ensure consistency between PFS and Pennylane SAS security policies, leveraging the group framework where appropriate while prioritising PFS's regulatory obligations. * Security by design: translate requirements into actionable standards and control expectations, embedded into product and engineering delivery. * Operational resilience: shape incident-management and continuity expectations, ensure they are testable, and drive evidence of effective execution. * Oversight of key stakeholders: establish effective oversight of Pennylane SAS and key providers, with clear expectations, monitoring and remediation follow-through. This is a role for a technically credible security leader with strategic judgement - with the technical depth to challenge architectures, controls and evidence, and the seniority to own governance and executive reporting. What will your day-to-day responsibilities be? * Own PFS Information Security policy: define, maintain and continuously improve PFS security governance, standards and policy set. * Manage the PFS risk and control framework: maintain the security risk taxonomy, control objectives, key risks/KRIs, escalation thresholds, and evidence expectations. * Embed security-by-design into the Product/Tech development cycle: leverage Pennylane SAS policies and existing ways of working where applicable, ensuring PFS security requirements and regulatory obligations are reflected in the delivery lifecycle, change process and go/no-go decisions, without creating unnecessary process overhead. * Ensure operational resilience / continuity / testing: define resilience requirements and ensure end-to-end testing and exercises produce usable evidence and tracked remediation. * Manage outsourcing arrangements and audits: oversee security aspects of outsourcing arrangements (intragroup and third parties), ensure auditability and follow through on findings and remediation. * Provide executive-level reporting: deliver clear, decision-oriented reporting on information-security posture, incidents, resilience testing and remediation to PFS management and the Supervisory Board. KPIs / signals: * Policy & standards effectiveness: evidence of adoption (e.g., security requirements consistently reflected in delivery artefacts for material initiatives) and reduction of recurring "same class" issues over time. * Core security KRIs (within risk appetite): a small set of measurable KRIs with thresholds and owners (e.g., critical vulnerability exposure, privileged-access exceptions, key third-party risks), tracked and escalated when outside appetite. * Resilience testing KPIs: tests/exercises executed vs plan; % of high-severity findings remediated within agreed timelines; retest completion for failed scenarios. * Incident classification & remediation tracking: consistent classification, timely escalation, and tracked remediation to closure (including post-incident action closure rate). * Audit follow-up tracking: audit findings/actions ageing, % overdue by severity, and executive visibility on the top overdue items. * Threat & vulnerability landscape monitoring: regular review of the external threat/vulnerability landscape and its concrete impact on PFS priorities (what changes in controls, monitoring, or roadmap). Ramp-up / expectations during the probation period: * Establish the initial PFS security governance baseline (policy set, decision rights, reporting cadence). * Propose and align a first set of PFS security KRIs and risk appetite thresholds (with owners and escalation path). * Produce a first resilience testing plan (what is tested, frequency, evidence expected) and agree success criteria. * Put in place an incident classification approach and a remediation tracking routine that is audit-ready., Nous pratiquons de nombreux sports ensemble et avons à cœur de nous réunir régulièrement autour d'événements d'entreprise tels que les Tech Days (qui permettent aux Pennylaners en remote de se réunir tous les 3 mois) ou notre séminaire d'entreprise qui a lieu une fois par an, et qui favorise de grands moments de cohésion pour toutes et tous. Pour t'épanouir chez Pennylane, il faudra: * Parler anglais (le niveau est évalué et apprécié en fonction du département auquel tu postules) * Apprécier travailler dans un environnement en changement constant * Faire de la collaboration une priorité au sein de son équipe ou avec d'autres parties prenantes * Avoir un recul suffisant pour prioriser les actions à fort impact business dans son activité quotidienne. Nous savons que certaines personnes sont moins susceptibles de postuler que d'autres si elles estiment ne pas remplir l'intégralité des critères.