Technical Security Governance Lead - Identity

WPP

WPP is the trusted growth partner for the world’s leading brands.  We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company – powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth.    We work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise.   Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow.    For more information, visit WPP.com.   Why we're hiring: We are looking to hire an individual that will own the identification, assessment, documentation and monitoring of digital and information security risks across WPP, ensuring risks are clearly articulated, consistently assessed and effectively tracked. What you'll be doing Risk Assessment & Management * Conduct enterprise and operational security risk assessments. * Ensure risk statements, impact and likelihood justifications are clear and defensible. * Maintain accurate and current risk records within approved GRC tooling. Risk Management * Conduct organisational-level, third-party or product risk assessments to identify technical, process and/or procedural vulnerabilities and recommend mitigation strategies. * Support the implementation of WPP’s Digital Security risk management framework, ensuring alignment with organisational goals. * Monitor and report on Key Risk Indicators (KRIs) to provide insights into WPP’s cybersecurity posture. Risk Treatment & Monitoring * Support risk owners in defining proportionate mitigation actions. * Track remediation progress and reassess residual risk. * Escalate material risk changes or overdue actions. What you'll need: Essential: * Fluent English (reading, writing, and conversation). * Bachelor’s degree in Information Security, Risk Management, or equivalent * Experience in cybersecurity governance, GRC, or risk support roles. * Strong understanding of cybersecurity policies, standards, and frameworks (e.g. ISO 27001, NIST CSF). * Ability to work with governance, assurance, and technical teams to maintain clear and usable frameworks. * Strong written communication skills, with high attention to accuracy and consistency. * Foundational understanding of cloud computing models (IaaS, PaaS, SaaS) and associated security risks. * Awareness of common cyber risk scenarios related to cloud platforms, SaaS environments, identity, and third-party integrations. * Exposure to emerging technology risks, such as AI-enabled systems, automation, and digital transformation initiatives. * Ability to assess risks across modern, distributed technology environments. * Foundational understanding of DevSecOps principles and secure-by-design approaches within modern software development lifecycles. * Ability to elevate the role to value-driven cyber risk management Nice - to- have * Certifications such as CISSP, CISM, or CRISC. * Familiarity with GRC tools and risk management platforms. * Working knowledge of agile methodologies. * Experience in multinational, multicultural and matrixed companies. Key Behaviours  & Competencies * Proactive Problem-Solving: Anticipates challenges in governance and compliance activities and develops effective solutions. * Collaborative: Builds strong relationships across teams (e.g., Legal, Enterprise Technology) to ensure alignment and efficiency. * Detail-Oriented: Ensures accuracy and consistency in governance documentation, role definitions, and standards. * Adaptable: Thrives in a fast-paced environment and adjusts quickly to changing priorities or regulatory requirements. * Ethical Integrity: Maintains high ethical standards, ensuring compliance with policies and safeguarding WPP’s reputation. * Analytical Thinking: Demonstrates strong analytical skills to interpret complex data and identify actionable insights. * Communication Skills: Clearly articulates findings, recommendations, and technical concepts to non-technical stakeholders. * Structured & Methodical: Applies a disciplined approach to governance maintenance and change control. * Collaborative: Works effectively with Strategy & Risk, TSG, Assurance, and Legal to support the governance lifecycle.   Who you are: You're open: We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working. You're optimistic: We believe in the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected. You're extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.   What we'll give you: Passionate, inspired people – We aim to create a culture in which people can do extraordinary work. Scale and opportunity – We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry. Challenging and stimulating work – Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge? #LI-Hybrid  We believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process. WPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers. PLEASE READ OUR PRIVACY NOTICE (HTTPS://WWW.WPP.COM/EN/CAREERS/WPP-PRIVACY-POLICY-FOR-RECRUITMENT) FOR MORE INFORMATION ON HOW WE PROCESS THE INFORMATION YOU PROVIDE.

WPP

WPP is the trusted growth partner for the world’s leading brands.  We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company – powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth.    We work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise.   Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow.    For more information, visit WPP.com.   Why we're hiring: The Security Awareness Specialist will lead the design, delivery, and continuous evolution of our global security awareness programme. This role owns the full training lifecycle—from planning and content creation through to monthly delivery, engagement, and performance measurement. As part of the global Digital Security & Risk Management function, you will play a key role in shaping secure behaviours across WPP. You’ll achieve this through engaging training experiences, behavioural nudges, and impactful monthly spotlight campaigns aligned to our annual strategy. This is a hands-on role requiring creativity, structure, and the ability to drive consistent behavioural change at scale through our learning platforms. What you'll be doing: Programme Planning * Develop and maintain the annual security awareness and behaviour change roadmap * Align monthly themes with key organisational risks, the evolving threat landscape, and regulatory requirements (e.g., ISO 27001/42001, SOC2) * Continuously enhance the programme using AI-driven approaches, microlearning, and behavioural science techniques Content Creation & Training Development * Design high-quality, engaging training content (videos, modules, microlearning, quizzes, infographics, behavioural nudges) * Craft clear, creative, and human-centred messaging for campaigns and monthly spotlights * Partner with security SMEs to translate complex technical risks into simple, actionable behaviours * Maintain and evolve a library of evergreen learning materials Training Delivery * Build, configure, and publish monthly training modules in the Learning Management System (LMS) * Ensure content is accessible, relevant, and consistent across regions and brands Monthly Spotlight Campaigns * Deliver targeted awareness campaigns aligned to the annual programme (e.g., phishing, identity security, AI safety, data handling) * Execute short-form behavioural nudges via email, intranet, and internal communications channels Measurement & Continuous Improvement * Track training completion, engagement, and behavioural outcomes * Analyse data from phishing simulations, LMS analytics, and incident trends to inform programme improvements * Produce monthly and quarterly reporting for the CISO and security leadership * Benchmark programme effectiveness against industry standards Collaboration & Stakeholder Management * Partner with Business Security Services leads and stakeholders to drive adoption and engagement * Support awareness initiatives during major incidents, policy updates, and key business events What you'll need: * Experience in security awareness, internal communications, learning design, or behavioural training * A strong ability to simplify complex cyber security concepts into clear, actionable messaging * Excellent storytelling, copywriting, and content creation skills * Hands-on experience with LMS platforms and e-learning authoring tools * Strong organisational and project management skills, with the ability to manage a consistent monthly cadence * Comfortable operating in a fast-paced, global environment * Solid understanding of cyber security fundamentals (e.g., phishing, identity, data handling, cloud, AI safety) * Familiarity with behavioural science principles (e.g., nudging, habit formation, reinforcement) is a plus Please submit your application in English. Who you are: You're open: We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working. You're optimistic: We believe in the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected. You're extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.   What we'll give you: Passionate, inspired people – We aim to create a culture in which people can do extraordinary work. Scale and opportunity – We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry. Challenging and stimulating work – Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge? #LI-Hybrid  We believe the best work happens when we're together, fostering creativity, collaboration, and connection. That's why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process. WPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committed to fostering a culture of respect in which everyone feels they belong and has the same opportunities to progress in their careers. PLEASE READ OUR PRIVACY NOTICE (HTTPS://WWW.WPP.COM/EN/CAREERS/WPP-PRIVACY-POLICY-FOR-RECRUITMENT) FOR MORE INFORMATION ON HOW WE PROCESS THE INFORMATION YOU PROVIDE.

Alan

HEALTH CAN’T WAIT. Not for symptoms to get worse. Not for a six‑month appointment. Not for a system to catch up. But that’s exactly how healthcare works today. You wait, until you can’t. Alan exists to end the wait. Health is a universal right, and we believe this right can only become real when it’s coupled with prevention. We need to stop treating health as something we repair and start treating it as something we build, every day. It’s not solely a question of willpower. It’s the healthcare system itself that needs to work for everyone, in a sustainable way. So we are building the new standard in prevention insurance. Alan is the first company that integrates insurance, prevention, and care into a single, acclaimed user experience. We are on an incredible journey to build a global leading company, with a unique culture. We already partner with 40K+ companies of all sizes, serving more than 1M+ members, and have reached €800M+ in ARR. Prevention as the new norm. That's what we're building with our team of 800+ people. If it speaks to you: we're hiring across France, Spain, Belgium, and Canada. And beyond. Alan operates at the intersection of health insurance, prevention, and regulated data. The person in this role owns the security governance and risk posture of a company that handles sensitive health data for 1M+ members, operates under DORA and HDS certification requirements, and is regulated by the ACPR. They work in close partnership with Legal, Internal Audit, and the broader Risk function — this is a collaborative role, not a siloed one. 🛡️ YOUR MISSION — GOVERNANCE, RISK & COMPLIANCE Own and operate the ISO 27001 ISMS. You are the accountable owner of the Information Security Management System — scope definition, Statement of Applicability, internal audit programme, and management review. You've led at least one full certification or recertification cycle and know what breaks down in the months between audits. Be the security expert in the room on regulatory and privacy matters — not the owner. Legal leads on DORA, HDS, RGPD, PGSSI-S, and regulatory relationships. Your role is to bring the technical and operational security substance: translating regulatory requirements into controls, flagging implementation gaps, and making sure the security programme holds up when the regulatory team negotiates with the ACPR or ANS. Run risk as a living programme, in partnership with the broader risk function. You lead security risk cartography using EBIOS RM and ensure it feeds into — and is informed by — the company-wide risk framework. You facilitate risk workshops, produce treatment plans, and bring the security lens to forums where non-security risks are also on the table. You know when a security risk is actually a business risk in disguise. Own the controls framework, but distribute ownership of controls themselves. You define the framework, set the standards, and track coverage — but the controls live with the teams who build and run the things they protect. You work closely with Infrastructure, Platform, and Engineering to ensure foundational building blocks (identity, network, secrets management, logging) are designed with security requirements embedded, not bolted on. You're a partner to those teams, not an auditor standing over them. Run audit cycles with rigour, in close partnership with Internal Audit. You manage the security audit programme and coordinate with certification bodies, but you're not operating in a vacuum. You work with Internal Audit to align scopes, avoid duplication, and present a coherent picture of control effectiveness to the board. You've sat in joint audit planning sessions and know how to make that relationship productive rather than territorial. Manage third-party risk with real teeth. You run vendor security assessments, define contractual security requirements (security annexes, DPAs). You partner with our Risk team, which oversees third-party risk, and own the security dimension. Bring the health sector context. You understand the ANS framework, CERT Santé requirements, and what it means to handle sensitive health data operationally — not just on paper. You're a useful partner to Legal when the question is "what does this regulation actually require us to do technically?" Own incident governance and support DORA reporting. You classify and escalate ICT incidents internally, own BCP and DRP governance, and provide the security substance for DORA incident reports. 🚀 WHAT YOU'LL BUILD AND WHO YOU'LL WORK WITH Next-Gen Compliance Framework: ISO 27001, DORA, HDS, NIS2 — multiple regulators, multiple countries, one coherent governance backbone. Build the system that lets Alan scale from 1M to many millions of members without rebuilding compliance every time. Automated Audit & Evidence Engine: Replace manual evidence collection with scripted pipelines plugged directly into engineering systems. Turn audit cycles from quarterly fire drills into a continuous capability. Living Risk Cartography: Risk treated as an operational signal, not a static deliverable. EBIOS RM at the core, feeding directly into business and engineering decisions. You'll work closely with Legal, DPO, Internal Audit, and the broader Risk function — and partner day-to-day with Infrastructure, Platform, Engineering, Product, and Operations. You're the bridge between regulatory complexity and operational simplicity. ⚡ WHY THIS ROLE IS SPECIAL Direct Impact: You own the trust foundation that lets Alan handle health data for 1M+ members and operate in highly regulated markets. Your work is the precondition for everything else Alan does. Complex Problems: 4 regulators across 4 countries, sensitive health data, and a regulatory landscape that keeps shifting (DORA, NIS2, AI Act) — to be modeled into a single, coherent control system. Ownership & Growth: Board and executive exposure, real influence on company-wide risk decisions, and the autonomy to shape Alan's security culture across 800+ people. 🤝 WHAT YOU WILL ALSO DO — TECHNICAL ENABLEMENT Automate compliance work wherever possible. You script evidence collection, automate control testing, and connect GRC tooling to engineering pipelines. You've used Python or similar to reduce the manual lift of an audit cycle, and you actively look for the next process to streamline. Configure and own GRC tooling, not just use it. You can administer platforms like CISO Assistant, ServiceNow GRC, or Archer — designing workflows, building dashboards, and making them actually useful for the teams that feed them data. Speak cloud governance fluently. You understand shared responsibility in HDS-qualified environments, know what CSPM tools surface and what they miss, and can reason about policy-as-code (OPA, SCP) without needing an engineer to translate. Read architecture well enough to challenge it. You can review a proposed architecture, identify control gaps in identity, network segmentation, encryption, or logging, and push back credibly in a room of engineers — without pretending to be one. Interpret vulnerability data and drive prioritisation. You read scan outputs, work with engineering teams to prioritise remediation by business risk rather than CVSS score, and track resolution KPIs over time. ⭐️ QUALIFICATIONS — MINDSET AND SOFT SKILLS You translate risk into business language. You can brief a board or an audit committee and make them feel informed — not overwhelmed or underwhelmed. You know the difference between a finding that requires an emergency board call and one that belongs in a quarterly report. You influence without authority. You align Legal, DPO, Risk, Engineering, Product, and Operations on security requirements without creating blockers or adversarial dynamics. People don't avoid you — they come to you early because you make their lives easier, not harder. You manage programmes with audit-grade rigor. You run structured, traceable roadmaps. You know where every commitment is, who owns it, and when it's due. You escalate proactively and don't let dependencies surprise you. You build security culture, not compliance theatre. Your awareness programmes land because they're relevant, not because they're mandatory. You foster proportionate risk ownership across the company — the goal is teams making better decisions, not teams checking boxes. You think in principles when frameworks shift. DORA is live. NIS2 transposition pace varies. The AI Act is arriving. You don't freeze when the regulatory landscape moves — you reason from first principles and adapt without waiting to be told what to do. 🌍 HOW WE WORK Location: Paris-based, hybrid. We value in-person collaboration and ask Alaners to be in the office part of the week. 🎯 We hire people, not checklists. If you're excited by this scope but don't check every box, we'd still love to hear from you.