Security & Compliance Engineer

Security & Compliance Engineer

BuyCo digitalizes and simplifies container shipping operations with a motto: “Shipping made easy”

Most of the things around you (your phone, your clothes, your coffee) crossed an ocean in a shipping container.

Behind each of those containers, a company has to book space on a ship, coordinate carriers, freight forwarders and customs agents, and keep track of dozens of documents, often still by email, phone and spreadsheet.

That's where we come in.

Our collaborative SaaS platform gives importers and exporters a single place to:

• book, organize and track their shipments from start to finish,
• work smoothly with their own teams and all their partners,
• get clear visibility on where their goods and documents are,
• use their data to make their supply chain more efficient and more sustainable.

Our mission: bring an industry that still relies heavily on manual work into the digital age, with a platform people actually enjoy using.

BuyCo was founded in 2015 by a team combining deep maritime expertise and a strong tech background. Today, we're around 50 people.

Solidly funded, we have ambitious plans: new features on the platform (like our CO2NTROL project, which helps clients measure and reduce the CO2 emissions of their shipments) and faster growth, with new clients, especially abroad.

Want to work with energetic, experienced people who care about results? Join us and help change the way goods move around the world

Job description

We are recruiting a Security & Compliance Engineer.

As BuyCo grows, especially abroad, security and compliance have become key expectations from our customers. BuyCo is ISO 27001 certified, SOC 2 certification is around the corner, and new regulations such as the EU AI Act are coming.

To support this ambition, we are looking for someone who combines strong hands-on security expertise, a solid tech culture and a taste for governance and compliance.

The role is a 50/50 split between security and compliance, with a stronger focus on security expertise. On the compliance side, you will be supported by our compliance automation platform, Drata.

You will play a key role in making BuyCo's platform more secure every day and in keeping our certifications and policies alive, while spreading a strong security culture across the company.

You will report directly to Joffrey, Head of Platform, and join a team with:

• Saad, Platform Engineer,
• Ludwig, Senior Cloud Engineer,
• César, Security & Compliance Administrator apprentice.

and work closely with:

• our Software Engineers,
• the Data team,

but also:

• all BuyCo teams, as security and compliance are everyone's business,
• our external partners: pentesters, security vendors and service providers, and customers' security teams.

What you will do on a daily basis:

Core tasks:

Platform security

• Secure the BuyCo platform by applying and promoting best practices across our infrastructure: AWS, Azure, data tools and Kubernetes.
• Act as BuyCo's pentest referent: work with pentesters, understand their findings and recommendations, and drive remediation with the engineering teams.
• Prioritize security topics based on risks, so the main risks are always covered.
• Spread a strong security culture: explain security choices in simple words and bring teams on board.

Security operations (run & build)

• Monitor, maintain and improve BuyCo's security stack: check alerts every day, triage and categorize them, and create tickets for the right teams.
• Improve our security tooling over time, and contribute to the choice of new tools and service providers.
• Manage access across the company: onboarding, offboarding and access levels.

Compliance & governance

• Maintain and improve our ISO 27001 certification and our SOC 2 certification (to obtain or maintain, depending on your start date), with the support of Drata.
• Write, update and improve our security policies, rules and processes.
• Prepare internal audits (at least once a year, ideally twice).
• Handle GDPR topics and their international equivalents (e.g. LATAM, Australia), and prepare BuyCo for the EU AI Act.
• Answer our customers' security questionnaires.

Your path at BuyCo:

We imagine (ideally) a journey like this one:

• 4 months after your arrival: you have a good grasp of the whole BuyCo platform: our infrastructure, Disaster Recovery Plan, SLAs and ISO 27001 framework. You can answer a customer's security questionnaire on your own.
• 8 months after your arrival: you have run a gap analysis between where we are and where we