CISO

Are you looking for a stimulating professional environment based on autonomy and trust?

Pennylane offers you the opportunity to grow within a rapidly growing company.

Here, your expertise will directly contribute to helping entrepreneurs regain control of their finances. Discover a place where your skills will be valued and where you can shape the future of financial management.

Our Vision

Our ambition is to become the preferred financial steering software for European SMEs.

We help entrepreneurs get rid of time-consuming accounting and finance tasks, while giving them access to key financial information to help them make the best decisions for their business.

At the same time, we help accounting firms by allowing them to spend less time on redundant and repetitive tasks, and more time on advising and supporting their clients.

About Pennylane

Pennylane is one of the fastest-growing FinTechs in France, and plans to enter the European market soon.

In its 6 years of existence, we have managed to:

💻 Position ourselves in the market as an innovative accounting and financial management solution provider

💰 Raise a total of 400 million euros from renowned investors, including Sequoia, the Silicon Valley flagship fund, known for supporting Google, Facebook, Airbnb, Stripe, Paypal, and many others in their early stages

👨‍👩‍👧‍👦 Grow from 7 co-founders to a team of 1200 employees, with an average Glassdoor rating of 4.9/5 and 94% of Glassdoor reviewers would recommend PL to their loved ones!

🌍 Build an international team composed of employees from 25 different countries, with a very flexible teleworking culture

🤝 Gain the trust of thousands of users and receive excellent feedback

🚀 More than 1,500,000 VSEs/SMEs and more than 7,000 accounting firms are already using Pennylane in France!

Why is this role important for Pennylane?

Pennylane is building Pennylane Financial Services (PFS), a newly created regulated subsidiary applying for ACPR authorisations as a payment institution and a financing company.

This step is foundational to delivering a comprehensive financial-services product for our clients, on a model that is robust, scalable, and supervision-ready.

From day one, the ACPR will expect PFS to demonstrate clear security governance, effective oversight of critical dependencies, and credible evidence of operational resilience - with a strong security-by-design approach.

How will you contribute to the project?

You will own PFS’s security governance and overall security and resilience policy, under the direct supervision of the Chief Compliance and Risk Officer.

Your contribution is to design a risk and control framework that is proportionate to PFS’s activity and regulatory expectations, and to ensure PFS can evidence "security by design" through auditable, inspection-ready artefacts.

In practice, this includes:

• Policy alignment: ensure consistency between PFS and Pennylane SAS security policies, leveraging the group framework where appropriate while prioritising PFS’s regulatory obligations.

• Security by design: translate requirements into actionable standards and control expectations, embedded into product and engineering delivery.

• Operational resilience: shape incident-management and continuity expectations, ensure they are testable, and drive evidence of effective execution.

• Oversight of key stakeholders: establish effective oversight of Pennylane SAS and key providers, with clear expectations, monitoring and remediation follow-through.

This is a role for a technically credible security leader with strategic judgement - with the technical depth to challenge architectures, controls and evidence, and the seniority to own governance and executive reporting.

What will your day-to-day responsibilities be?

• Own PFS Information Security policy: define, maintain and continuously improve PFS security governance, standards and policy set.

• Manage the PFS risk and control framework: maintain the security risk taxonomy, control objectives, key risks/KRIs, escalation thresholds, and evidence expectations.

• Embed security-by-design into the Product/Tech development cycle: leverage Pennylane SAS policies and existing ways of working where applicable, ensuring PFS security requirements and regulatory obligations are reflected in the delivery lifecycle, change process and go/no-go decisions, without creating unnecessary process overhead.

• Ensure operational resilience / continuity / testing: define resilience requirements and ensure end-to-end testing and exercises produce usable evidence and tracked remediation.

• Manage outsourcing arrangements and audits: oversee security aspects of outsourcing arrangements (intragroup and third parties), ensure auditability and follow through on findings and remediation.

• Provide executive-level reporting: deliver clear, decision-oriented reporting on information-security posture, incidents, resilience testing and remediation to PFS management and the Supervisory Board.

KPIs / signals:

• Policy & standards effectiveness: evidence of adoption (e.g., security requirements consistently reflected in delivery artefacts for material initiatives) and reduction of recurring “same class” issues over time.

• Core security KRIs (within risk appetite): a small set of measurable KRIs with thresholds and owners (e.g., critical vulnerability exposure, privileged-access exceptions, key third-party risks), tracked and escalated when outside appetite.

• Resilience testing KPIs: tests/exercises executed vs plan; % of high-severity findings remediated within agreed timelines; retest completion for failed scenarios.

• Incident classification & remediation tracking: consistent classification, timely escalation, and tracked remediation to closure (including post-incident action closure rate).

• Audit follow-up tracking: audit findings/actions ageing, % overdue by severity, and executive visibility on the top overdue items.

• Threat & vulnerability landscape monitoring: regular review of the external threat/vulnerability landscape and its concrete impact on PFS priorities (what changes in controls, monitoring, or roadmap).

Ramp-up / expectations during the probation period:

• Establish the initial PFS security governance baseline (policy set, decision rights, reporting cadence).

• Propose and align a first set of PFS security KRIs and risk appetite thresholds (with owners and escalation path).

• Produce a first resilience testing plan (what is tested, frequency, evidence expected) and agree success criteria.

• Put in place an incident classification approach and a remediation tracking routine that is audit-ready.

Profile we are looking for

Must-have

• Fintech and/or Banking experience

• Strong experience in information security, technology risk, cyber-risk or security assurance, with ownership of complex topics.

• Proven ability to design and run security governance and a risk/control framework with audit-ready evidence.

• Experience working with outsourced / third-party / group-shared technology services while retaining accountability.

• Strong stakeholder management and communication skills, including executive-level reporting.

• Professional fluency in French and English.

Nice to have

• Operational resilience experience, including DORA-aligned practices (incident management, continuity, testing, third-party oversight).

• Knowledge of payment and authentication topics (SCA, strong authentication and account recovery patterns).

• Exposure to PCI DSS scope and payment-card security concepts.

• Payment fraud and transaction-monitoring familiarity (fraud patterns, controls, investigations, and collaboration with Fraud/AML stakeholders).

Recruitment Process

1. Interview with Lucie (30-45 min), Senior Recruiter

2. Interview with Laurent (1h), Chief Risk & Compliance Officer

3. Case Study with Laurent and Léa (1h)

4. Last round with Stanislas and Felix (45 min)

🎁 What we can offer you:

🏥 A health insurance plan among the best on the market (Alan Blue and Alan Mind)

🍜 Meal vouchers (Swile Card)

🏝 Between 6 and 12 additional RTT days on top of the 5 weeks of paid leave

🧑‍💻 A dedicated monthly budget for all our Pennylaners, supporting remote work or co-working spaces

🏢 Easy access to our offices, located a few minutes from Saint Lazare in the heart of Paris

💵 A pool of BSPCE (employee stock options)

🏃‍♀️ Access to 8,000 gyms across France and over 300 wellness activities through our partner Gymlib

💻 A Mac

🎉 We practice many sports together and are keen to gather regularly for company events such as Tech Days (which allow remote Pennylaners to meet every 3 months) or our annual company seminar, fostering great moments of cohesion for everyone.

To thrive at Pennylane, you will need to:

-Speak English (the level is assessed and appreciated based on the department you are applying for)

-Enjoy working in a constantly changing environment

-Prioritize collaboration within your team or with other stakeholders

-Have sufficient perspective to prioritize high-impact business actions in your daily work.

We know that some people are less likely to apply than others if they feel they do not meet all the criteria.

If you are hesitant, we encourage you to apply anyway: who knows, it could be the beginning of a significant and lasting collaboration!

Important information for candidates

Recruitment scam attempts are on the rise. We invite you to remain vigilant during your interactions.

Applications only through our official channels: apply exclusively through our offers published on our official platforms (careers site, official partner pages).

Always verify the sender's email address: our communications are sent from professional addresses with the domains @pennylane.com or ----- .

We will never ask you for payment or financial information (bank details, payment for an interview, purchase of equipment, etc.) as part of the recruitment process.

If such a request is made to you, it is a fraud. We invite you to not respond and to report it to us immediately.

Encouraging diversity, equity, and inclusion in all its forms, Pennylane offers an inclusive, supportive, and growth-conducive work environment, both in our offices and remotely. We are committed to providing equal opportunities to all our candidates, regardless of their social and ethnic background, gender, religion, sexual orientation, or disability.

🇫🇷 Personal Data

Pennylane processes your data to manage your application and assess your suitability for the role. If your application is unsuccessful, your data may be retained for 2 years from our last exchange or the closing of the recruitment process, in order to build and manage a candidate pool. You can object at any time and request the deletion of your data by writing to: Learn more

🇬🇧 Personal Data

Pennylane processes your data to manage your application and assess your suitability for the position. If your application is unsuccessful, your data may be retained for 2 years from our last exchange or the closing of the recruitment process, in order to build and manage a candidate pool. You may object at any time and request the deletion of your data by writing to Learn more

🇩🇪 Personenbezogene Daten

Pennylane verarbeitet Ihre Daten, um Ihre Bewerbung zu bearbeiten und Ihre Eignung für die Stelle zu beurteilen. Sollte Ihre Bewerbung nicht erfolgreich sein, können Ihre Daten bis zu 2 Jahre ab unserem letzten Austausch oder dem Abschluss des Rekrutierungsverfahrens gespeichert werden, um einen Kandidatenpool aufzubauen und zu verwalten. Sie können jederzeit Widerspruch einlegen und die Löschung Ihrer Daten beantragen, indem Sie an Mehr erfahren

🇪🇸 Datos personales

Pennylane trata sus datos para gestionar su candidatura y evaluar su idoneidad para el puesto. En caso de que su candidatura no sea seleccionada, sus datos podrán conservarse hasta 2 años a partir de nuestro último contacto o de la finalización del proceso de selección, con el fin de constituir y gestionar una reserva de candidatos. Puede oponerse en cualquier momento y solicitar la eliminación de sus datos escribiendo a Más información

Find Jobs in France on Arbeitnow