Lead, Information Security

As Lead, Information Security at Bitpanda, you are a senior individual contributor who sets direction and solves complex governance, risk, and compliance (GRC) problems in a regulated fintech environment. You shape security governance strategy, ensure the control framework remains effective as the business scales, and act as a key advisor to security leadership and senior business stakeholders on risk and compliance decisions. You'll lead high-impact initiatives across multiple entities and regions, influence across the organisation, and raise the bar for how Bitpanda designs, tests, and evidences security controls.

What you'll do

• Define a multi-year GRC roadmap aligned to business strategy, risk appetite, and regulatory expectations (such as DORA readiness, audit strategy, and control maturity targets), and drive control framework evolution by rationalizing controls, reducing duplication, and ensuring proportionality based on criticality, data sensitivity, and business impact.
• Advise leadership on material risk decisions including risk acceptance, remediation prioritisation, control investments, and scope decisions, and produce executive-grade outputs such as risk narratives, board and committee materials, and regulator and customer responses with defensible rationale.
• Own strategy and approach for major audits and assurance activities (ISO 27001, SOC 2, regulatory examinations, and key client due diligence), including scope, positioning, and negotiation, and lead responses to complex audit and regulatory issues through root-cause analysis, corrective action programs, and sustained effectiveness verification.
• Serve as subject matter expert for one or more domains such as ISMS/ISO 27001 at scale across multiple entities, DORA and operational resilience governance, third-party risk for critical ICT providers, or security control assurance and testing program design.
• Set standards and reusable artifacts including control narratives, evidence templates, testing methodologies, and playbooks, mentor specialists and associates to raise organisation-wide capability, and partner with Security Engineering, IT, and Compliance to embed controls into workflows.

What you bring

• Typically 7 to 10+ years of experience in information security GRC, audit and assurance, security risk, compliance, software engineering, or financial services risk roles.
• Demonstrated ownership of complex, multi-stakeholder GRC programs and successful navigation of audits and regulatory scrutiny.
• Deep working knowledge of ISO 27001 and DORA, and strong familiarity with adjacent frameworks (SOC 2, NIST CSF, BaIT, COBIT), including how to test and evidence controls.
• Strong technology risk understanding across cloud, IAM, SDLC governance, incident management, vulnerability management, logging and monitoring, and crypto/fintech operational processes as relevant.
• Ability to influence across the organisation and resolve conflicts with a risk-based, outcome-oriented approach.

What we offer

• Hybrid working model with the flexibility to work 25 additional days per year from a city or country of your choice.
• Competitive total compensation package aligned with Bitpanda's pay-for-impact policy, including participation in the stock option plan.
• Unlimited access to Udemy's library of online courses for continuous learning and growth.
• Confidential coaching, counselling, and mental health resources through OpenUP.
• 3 additional paid days off per year to rest and recharge (available after 6 months with Bitpanda).
• Up to 8 additional weeks of gender-neutral new parent leave.
• Free onsite dining in Vienna, Bucharest, Barcelona, and Berlin (freshly prepared lunches and snacks).
• Recognition and rewards for tenure and contributions.
• Discounts, rewards, and perks from partners worldwide across lifestyle, wellness, tech, and travel.
• Exclusive Bitpanda-branded merchandise and gear.
• Company events including the Winter Party in Vienna and gatherings worldwide.

About Bitpanda

Founded in 2014 in Vienna, Austria, Bitpanda is a user-friendly investment platform empowering over 7 million customers across Europe to invest in cryptocurrencies, crypto indices, stocks, precious metals, and commodities 24/7. Operating across Europe with teams in multiple time zones, Bitpanda is positioned as one of Europe's safest and most secure platforms for modern investing.