GRC Engineer

What we believe GRC is becoming

GRC today still runs the way it ran twenty years ago: evidence screenshots, annual reviews, controls verified after the fact. Meanwhile systems ship several times a day, generative AI redraws the attack surface every quarter, and NIS2, DORA, the AI Act and the CRA keep stacking requirements nobody can meet by hand.

We think the discipline has to move to what the community calls GRC Engineering, formalised in the collective grc.engineering manifesto and carried by voices such as Ayoub Fandi and his GRC Engineer newsletter: applying to governance, risk and compliance the same engineering rigour that transformed software (Agile, DevOps, DevSecOps, CI/CD). In practice: invert the flow (start from real systems, not from top-down frameworks), automate early and often instead of absorbing manual toil, reason from evidence and data rather than from fear and approximation, aim for measurable risk outcomes rather than checkbox compliance, and move from shallow periodic monitoring to deep continuous assurance.

Mindlapse builds the platform that makes that shift operational for large French and European accounts: an agentic product where AI, agents and automation are design primitives, and where compliance becomes a property measured continuously against the customer's real systems.

We are not looking for a classic GRC consultant, nor a product manager, nor a salesperson. We are looking for all three at once, with genuine technical appetite, in one head, and someone who shares the conviction above.

The role mirrors what the three founders (Hervé, Julien and Christophe, ex-Openminded, ex-Accenture) do day to day, in a tighter scope, with direct mentoring and the safety of never facing a large account alone.

Three years in, you will have seen more than in seven years at a consultancy or a large group, and you will have helped shape a profession that hardly exists in France today.

What GRC Engineering looks like in your week:

Customer success & delivery (~30%)

• Run our large-account proofs of concept (scoping, milestones, co-design workshops, read-outs) with one goal: convince customers that a different approach to GRC is now possible thanks to AI.

• Own delivery on the customer side: implement our approach close to the ground, support customers as they evolve, manage rollouts, and make security and business teams more autonomous.

• Support distribution and integration partners once we move to indirect sales.

Pre-sales (~25%)

• Prepare and run demos for CISOs, CIOs, compliance and procurement: prove the value of the platform and what the shift to GRC 2.0 actually buys them.

• Answer RFPs alongside the founders (specifications, scoring grids, technical submissions, orals), taking into account how much AI has changed that exercise.

Product management (~25%)

• Live the "GRC as a product" principle: translate business expectations and regulatory logic (NIS2, DORA, AI Act) into specifications the dev and AI team can build from.

• Set the view on what to ship and why: when the user clicks here, this is the business process that must fire, this is how the indicator is computed, this is the regulatory logic behind it.

• Be the bridge between the cyber/GRC domain and engineering, and bring developers and AI engineers up the domain curve.

Technical (~20%)

• This is where "GRC as code" gets concrete: contribute to the codebase now and then (fixes, wording adjustments, small changes) and automate delivery rather than absorb it.

• Comfortable shipping a simple fix with Claude Code, done properly: review, pull request, no magic. We are not asking you to become a lead developer.

• Build and maintain internal tooling (import scripts, Notion/Linear dashboards, n8n automations): automate early and often, exactly what we preach.

• A GRC Engineer role that barely exists in France yet, on a product built precisely for the discipline.

• Direct mentoring from the three founders on pre-sales, product and cyber-GRC.

• A technical team of around a dozen people, and a product already deployed at our first large-account customers.

• An environment where AI tooling is taken seriously (Claude Code, CodeRabbit, Linear, Notion) and where you can automate anything that should be automated.

• A supportive team that values autonomy, initiative and a diversity of backgrounds.

You are the right person if:

• You have 3 to 5 years in cyber/GRC consulting, in a technical services firm, in B2B SaaS pre-sales, or in cyber/risk-oriented product management. We also look at people straight out of school with a long internship at a cyber consultancy or a software vendor, in that case we calibrate the scope accordingly and will not expect the same autonomy from day one.

• You have enough cyber and GRC grounding to hold a credible conversation with a CISO: ISO 27001, NIS2, DORA, EBIOS RM, risk analysis, supplier assessments, regulatory compliance. You do not need to master all of it, as long as you learn fast and can name what you do not know yet.

• You share the GRC Engineering view: you find it absurd to produce evidence screenshots when the system can be queried continuously, and you want to help build the alternative.

• You are comfortable in front of customers: running a demo, facilitating a workshop, handling a CISO's objection, and reformulating a business need cleanly.

• You can code a little (TypeScript / Python / SQL) and have already folded Claude Code, Copilot or an equivalent into your workflow. Opening a pull request for a simple fix does not scare you.

• You think in product terms: you can tell a customer need from a feature, prioritise, and make trade-offs.

If you want to specialise in a single craft (pre-sales only, product only, consulting only), this is not the place. If you want to learn four of them in parallel alongside the founders and become a rare profile on the European market, we will get along.

Three steps, all remote:

1. A first conversation with Hervé (CEO) to go through your background, how you see the hybrid role, and what motivates you.

2. An interview with Julien (COO/Product) or Christophe (CPTO) to dig into the product or technical side, depending on your profile.

3. A working session: present a product demo and a customer-case read-out. We look at how you structure, how you pitch, and how you handle objections.