Information Security Officer

Location: Paris 08ème, hybrid (half week in the office) Contract: Permanent (CDI) Start date: Q1 2027 Reports to: VP Engineering About Decade Energy Founded in 2024, Decade Energy accelerates the electrification of road transport by developing, financing and operating the infrastructure that enables fleets to electrify: grid connections, battery energy storage systems (BESS), EV charging, and optimisation software. Our mission is simple: make electric the most competitive option for road transport. With roots in the Volta Trucks journey, our team brings together expertise in energy, mobility and project finance. We help transport operators and real estate owners secure power capacity, unlock new revenue streams and reduce energy costs, with no upfront investment in infrastructure. Together, we are building the Depot of the Future. Why this role exists Our batteries connect to the electricity grid. Security is therefore not an IT topic only: it is a condition to sell and to finance. NIS2 is enforced in Germany now and arrives in France. The Cyber Resilience Act (CRA) follows in 2027. Our customers are large logistics real-estate owners. They pass these requirements down to us by contract. Our insurers and lenders ask for the same evidence. You will be the first person at Decade to own security end to end. The role You own information security end to end. You start inside the software team and report to the VP Engineering. At 30 people, there is nobody to be chief of. We look for the person who does the work: you configure the tools, you write the requirements, you challenge the suppliers yourself. If you need a team before you can act, this role is not for you. If you know how to rally teammates across the company to build the security function from zero, this role is yours to shape. This is not 100% compliance, and not 100% security operations. It is a startup job: you build the shields while the arrows already fly. Some will get through - your work decides how much they hurt. The role covers four areas: Certifications, insurance, contracts. Drive the ISO 27001 program with an external partner. Determine our NIS2 and CRA scope in France and Germany. Define the insurance coverage for IT and OT (operational technology) risks with the C-level. Review the security clauses in customer contracts. Company IT security. Deploy endpoint protection on every device. Harden our Google Workspace. Make onboarding and offboarding safe by default. Manage physical access to our offices. Product and supplier security. Write and maintain the security requirements for every energy management system (EMS) on our sites: the one we build, and the ones supplied by our EPC (Engineering, Procurement, and Construction) partners, the contractors that build our sites. Secure our APIs. Assess our EMS suppliers, and put security requirements into the EPC contracts. Prepare an independent security audit. On our own EMS, the development team implements: you set the requirements and you verify them. On the supplier EMS, you assess the vendors, and you drive the network and access controls that Decade owns. Detection and response. Set up the monitoring we need. Write the incident response plan. When an incident happens, run the response and the NIS2 reporting. Your first six months Launch the ISO 27001 program and select the external partner. Map our contractual security exposure: customer contracts and the batteries we own. Write the security requirements spec that applies to our own EMS and to the supplier EMS. Put this spec into the EPC contracts, and collect security evidence from the EMS suppliers. Register us under NIS2 in Germany, and set up the duties that follow: incident reporting, measures evidence, management briefings. Choose and deploy endpoint protection on every company device. Propose the IT + OT insurance coverage to the C-level. Your profile You went through at least one certification (ISO 27001 or equivalent), as driver or as contributor. You assessed the security of a supplier or a partner before: questionnaires, evidence review, contract clauses. You secured a software or industrial product before, so you can write requirements that a supplier cannot talk around. You are hands-on: you configure the tools yourself. You can tell us about a security control you chose not to implement, and why. You work in English and in French. A plus: OT security, IEC 62443, the energy sector, industrial protocols (Modbus), cloud security, digital sovereignty, German. What we offer Build a security function from zero, with board support and a real regulatory driver. The full security perimeter from day one: compliance, IT security, and the security of our own software. It is more work than one person can hold: you set the order, and you build the team that follows. Direct exposure to the C-level and to the board. Benefits at Decade Stock options (BSPCE) Days off: 25 non-working days per year (CP) + RTT Health insurance ("Mutuelle") fully covered by Decade. Meal vouchers "Ticket Restaurant" (€12 per working day, 50% paid by Decade). Public transport 50% of costs covered (Pass Navigo or Forfait Mobilité durables) Ready to apply? Send your application to cyril.champier@decade.energy