Lead, Information Security

As Lead, Information Security at Bitpanda, you are a senior individual contributor who sets direction and solves complex governance, risk, and compliance (GRC) problems in a regulated fintech environment. You shape the security governance strategy, ensure the control framework remains effective as the business scales, and act as a key advisor to security leadership and senior business stakeholders on risk and compliance decisions. You lead complex, high-impact initiatives spanning multiple entities and regions, influence across the organisation, and raise the bar for how security controls are designed, tested, and evidenced.

What you'll do

• Define and own a multi-year GRC roadmap aligned to business strategy, risk appetite, and regulatory expectations such as DORA readiness, audit strategy, and control maturity targets. Drive control framework evolution by rationalizing controls, reducing duplication, and ensuring proportionality based on criticality, data sensitivity, and business impact. Establish governance principles including minimum control baselines, exception governance, and evidence-by-design.
• Advise leadership on material risk decisions including risk acceptance, remediation prioritisation, control investments, and scope decisions. Produce executive-grade outputs such as risk narratives, board and committee materials, and regulator and customer responses with defensible rationale. Facilitate senior stakeholder alignment when priorities conflict between delivery speed and control rigor, or cost and assurance depth.
• Own strategy and approach for major audits and assurance activities including ISO 27001, SOC 2, regulatory examinations, and key client due diligence, including scope, positioning, and negotiation. Lead responses to complex audit and regulatory issues through root-cause analysis, corrective action programs, and sustained effectiveness verification.
• Serve as subject matter expert for one or more domains depending on organisational needs: ISMS/ISO 27001 at scale across multiple entities with continuous compliance; DORA and operational resilience governance including control mapping, ICT risk integration, and testing oversight; Third-party risk for critical ICT providers including oversight model, ongoing monitoring, and exit and continuity governance; Security control assurance including testing program design, evidence standards, and control health metrics.
• Set standards and create reusable artifacts including control narratives, evidence templates, testing methodologies, and playbooks. Mentor specialists and associates to raise organisation-wide capability through coaching and review. Partner with Security Engineering, IT, and Compliance teams to embed controls into workflows and automate where possible.

What you bring

• Typically 7-10+ years of experience in information security GRC, audit and assurance, security risk, compliance, software engineering, and/or financial services risk roles.
• Demonstrated ownership of complex, multi-stakeholder GRC programs and successful navigation of audits and regulatory scrutiny.
• Deep working knowledge of ISO 27001 and DORA, with strong familiarity of adjacent frameworks such as SOC 2, NIST CSF, BaIT, and COBIT, including how to test and evidence controls.
• Strong technology risk understanding across cloud, IAM, SDLC governance, incident management, vulnerability management, logging and monitoring, and crypto and fintech operational processes as relevant.
• The ability to influence across the organisation and resolve conflicts with a risk-based, outcome-oriented approach.

What we offer

• Hybrid working model with the flexibility to work onsite or remotely, plus 25 additional days per year to work from a city or country of your choice.
• Competitive total compensation package aligned with Bitpanda's pay-for-impact policy, including participation in the stock option plan.
• Confidential coaching, counselling, and mental health resources through OpenUP.
• 3 additional days of paid time off beyond standard annual leave to rest and recharge (available after 6 months with the company).
• Unlimited access to Udemy's library of online courses for continuous learning and career growth.
• Exclusive discounts, rewards, and perks from partners worldwide across lifestyle, wellness, tech, and travel.
• Up to 8 additional weeks of gender-neutral new parent leave.
• Free onsite dining with freshly prepared lunches and snacks at offices in Vienna, Bucharest, Barcelona, and Berlin.
• Recognition and rewards for tenure and contributions.
• Exclusive Bitpanda-branded merchandise and gear.
• Company events including the Winter Party in Vienna and gatherings worldwide.
• Location-specific benefits designed to enhance life at Bitpanda.

About Bitpanda

Founded in 2014 in Vienna, Austria, Bitpanda is a user-friendly investment platform serving more than 7 million customers across Europe. The platform empowers investors to trade cryptocurrencies, crypto indices, stocks, precious metals, and commodities 24/7, and is recognised as one of Europe's safest and most secure platforms. Bitpanda's global team works across different cultures and time zones to deliver innovative products and services.