information security engineer in fintech

Bitpanda operates a trade-everything investment platform that enables more than 7 million customers to invest in cryptocurrencies, crypto indices, stocks, precious metals, and commodities. Headquartered in Austria, it operates across Europe.

• Define a multi-year GRC roadmap aligned with business strategy, risk appetite, and regulatory expectations
• Evolve the control framework by rationalizing controls, reducing duplication, and ensuring proportionality based on criticality, data sensitivity, and business impact
• Establish governance principles, including minimum control baselines, exception governance, and evidence-by-design
• Advise leadership on material risk decisions, including risk acceptance, remediation prioritization, control investments, and scope decisions
• Produce executive-grade risk narratives, board and committee materials, and regulator and customer responses with defensible rationale
• Facilitate senior stakeholder alignment when priorities conflict
• Own the strategy and approach for major audits and assurance activities, including ISO 27001, SOC 2, regulatory examinations, and key client due diligence
• Lead responses to complex audit and regulatory issues, including root-cause analysis, corrective action programs, and sustained effectiveness verification
• Serve as an SME in one or more areas: ISMS/ISO 27001 at scale, DORA and operational resilience governance, third-party risk for critical ICT providers, or security control assurance
• Set standards and reusable artifacts, including control narratives, evidence templates, testing methodologies, and playbooks
• Mentor specialists and associates through coaching and review
• Partner with Security Engineering, IT, and Compliance to embed controls into workflows, using policy-to-automation where possible

• Typically 7–10+ years of experience in information security GRC, audit/assurance, security risk, compliance, software engineering, and/or financial services risk roles
• Demonstrated ownership of complex, multi-stakeholder GRC programs and successful navigation of audits and regulatory scrutiny
• Deep working knowledge of ISO 27001 and DORA, and strong familiarity with SOC 2, NIST CSF, BaIT, and COBIT, including control testing and evidence
• Strong technology risk understanding across cloud, IAM, SDLC governance, incident management, vulnerability management, logging/monitoring, and crypto/fintech operational processes as relevant
• Ability to influence across the organization and resolve conflicts with a risk-based, outcome-oriented approach

• Competitive total compensation package aligned with Bitpanda’s pay-for-impact policy, including participation in its stock option plan
• Confidential coaching, counselling, and mental health resources through OpenUP
• Three additional paid days off in 2027 after six months with the company
• Unlimited access to Udemy’s online course library
• Discounts, rewards, and perks from partners worldwide across lifestyle, wellness, tech, and travel
• Up to eight additional weeks of gender-neutral new parent leave
• Free onsite dining, freshly prepared lunches, and snacks for employees in Vienna, Bucharest, Barcelona, and Berlin
• Tenure recognition and rewards, Bitpanda-branded merchandise, and company events
• 25 Additional days per year to work from a city or country of choice
• Hybrid model: three days onsite and two days from home; exceptions apply to shift-schedule teams and roles requiring office presence