information security specialist for GRC in fintech

Bitpanda operates a user-friendly investment platform where customers can invest in cryptocurrencies, crypto indices, stocks, precious metals, and commodities. Its products serve more than 7 million customers across Europe.

• Own and evolve GRC domains end-to-end, including strategy, annual plans, operating cadences, and success metrics
• Rationalize controls and tailor them to risk, strengthening controls for critical and regulated assets while streamlining low-risk areas
• Facilitate and challenge high-impact risk assessments for new products, major architectural changes, and critical vendors
• Drive risk treatment by aligning owners, negotiating timelines, tracking commitments, and escalating risks above appetite
• Lead complex, multi-entity and regulator-facing audits and assessments, from readiness and walkthroughs through remediation
• Design and run a risk-based control testing program, identify weaknesses, and drive lasting remediation through process improvements, automation, and tooling
• Translate regulatory requirements into structured internal work programs
• Set due diligence and ongoing monitoring requirements for critical suppliers
• Partner with Procurement and Legal on security contract requirements and supply-chain oversight
• Mentor Specialists, Associates, and Senior Associates; set standards for documentation, evidence, and stakeholder engagement
• Help engineering and operations teams implement requirements efficiently and consistently

• Typically 6–10 years of experience in information security GRC, audit/assurance, risk management, compliance, or adjacent security roles
• Proven experience leading audits or assessments and driving remediation across multiple teams and systems
• Strong working knowledge of ISO 27001 and DORA, and/or SOC 2, PCI DSS, or NIST
• Ability to design controls, define evidence, and test control effectiveness
• Strong understanding of technology risk across cloud, IAM, SDLC governance, incident management, vulnerability management, logging and monitoring, and third-party risk
• Excellent written and verbal communication skills, including producing executive-ready materials and auditor-facing narratives

• Competitive total compensation package aligned with Bitpanda’s pay-for-impact policy, including participation in its stock option plan
• Confidential coaching, counselling, and mental health resources through OpenUP
• Three additional paid days off in 2027 after six months with the company
• Unlimited access to Udemy’s online course library
• Discounts, rewards, and partner perks across lifestyle, wellness, technology, and travel
• Up to eight additional weeks of gender-neutral new parent leave
• Free onsite dining, including freshly prepared lunches and snacks, for employees in Vienna, Bucharest, Barcelona, and Berlin
• Tenure recognition and rewards, Bitpanda-branded merchandise, and company events
• Additional 25 days per year to work from a city or country of choice
• Hybrid schedule: three days onsite and two days from home; exceptions apply to shift-based teams and roles requiring onsite work
• Applicants must possess an EU passport or a valid work permit authorising work in the hiring location
• Applicants are asked to provide their notice period and annual gross salary expectations and confirm availability for the required hybrid schedule of three office days per week