Expert, Information Security

As an Information Security Expert at Bitpanda, you are a senior individual contributor who sets direction and solves complex governance, risk and compliance (GRC) problems in a regulated fintech environment. You shape security governance strategy, ensure control frameworks remain effective as the business scales, and act as a key advisor to security leadership and senior business stakeholders on risk and compliance decisions. You lead complex, high-impact initiatives across multiple entities and regions, influence across the organisation, and raise the bar for how security controls are designed, tested, and evidenced.

What you'll do

• Define and own a multi-year GRC roadmap aligned to business strategy, risk appetite, and regulatory expectations such as DORA readiness, audit strategy, and control maturity targets. Drive control framework evolution by rationalising controls, reducing duplication, and ensuring proportionality based on criticality, data sensitivity, and business impact. Establish north star principles for governance including minimum control baselines, exception governance, and evidence-by-design.
• Advise leadership on material risk decisions including risk acceptance, remediation prioritisation, control investments, and scope decisions. Produce executive-grade outputs such as risk narratives, board and committee materials, and regulator and customer responses with defensible rationale. Facilitate senior stakeholder alignment when priorities conflict between delivery speed and control rigor, or cost and assurance depth.
• Own strategy and approach for major audits and assurance activities such as ISO 27001, SOC 2, regulatory examinations, and key client due diligence, including scope, positioning, and negotiation. Lead responses to complex audit and regulatory issues including root-cause analysis, corrective action programs, and sustained effectiveness verification.
• Serve as a subject matter expert for one or more of the following depending on business needs: ISMS and ISO 27001 at scale across multiple entities with continuous compliance; DORA and operational resilience governance including control mapping, ICT risk integration, and testing oversight; Third-party risk management for critical ICT providers including oversight models, ongoing monitoring, and exit or continuity governance; Security control assurance including testing program design, evidence standards, and control health metrics.
• Set standards and create reusable artifacts including control narratives, evidence templates, testing methodologies, and playbooks. Mentor specialists and associates to raise organisation-wide capability through coaching and review. Partner with Security Engineering, IT, and Compliance teams to embed controls into workflows, moving from policy to automation where possible.

What you bring

• Typically 7 to 10+ years of experience in information security GRC, audit and assurance, security risk, compliance, software engineering, or financial services risk roles.
• Demonstrated ownership of complex, multi-stakeholder GRC programs and successful navigation of audits and regulatory scrutiny.
• Deep working knowledge of ISO 27001 and DORA, with strong familiarity of adjacent frameworks such as SOC 2, NIST CSF, BaIT, and COBIT, including how to test and evidence controls.
• Strong technology risk understanding across cloud, IAM, SDLC governance, incident management, vulnerability management, logging and monitoring, and crypto or fintech operational processes as relevant.
• The ability to influence across the organisation and resolve conflicts with a risk-based, outcome-oriented approach.

What we offer

• Hybrid working model combining onsite collaboration and remote work, plus 25 additional days per year to work from a city or country of your choice.
• Competitive total compensation package aligned with Bitpanda's pay-for-impact policy, including participation in the stock option plan.
• Confidential coaching, counselling, and mental health resources through OpenUP.
• 3 additional days of paid time off to rest and recharge, available once you have been with Bitpanda for 6 months.
• Unlimited access to Udemy's library of online courses for continuous learning and skill development.
• Discounts, rewards, and perks from partners worldwide across lifestyle, wellness, tech, and travel.
• Up to 8 additional weeks of gender-neutral new parent leave.
• Free onsite dining with freshly prepared lunches and snacks at Bitpanda offices in Vienna, Bucharest, Barcelona, and Berlin.
• Recognition and rewards for tenure and achievements at Bitpanda.
• Exclusive Bitpanda-branded merchandise and gear.
• Company events including the Winter Party in Vienna and gatherings worldwide.

About Bitpanda

Founded in 2014 in Vienna, Austria, Bitpanda is one of Europe's safest and most secure investment platforms, serving more than 7 million customers. The company empowers investors to trade cryptocurrencies, crypto indices, stocks, precious metals, and commodities 24/7, helping people build financial freedom. Bitpanda operates across Europe with a global team combining diverse perspectives and innovative thinking to remain at the cutting edge of the industry.