Security Operations & Risk Automation Engineer

As a Security Operations & Risk Automation Engineer at BVNK, you play a pivotal role in fortifying, enhancing, and scaling our information security function. You leverage cutting-edge automation technologies to reduce systemic risk by continuously discovering technical, procedural, and workflow vulnerabilities, automating user access reviews, and enforcing compliance guardrails across disparate, decentralized environments. Working closely with the Information Security Architect and the Information Security GRC expert, you design automated processes to monitor custom tools and decentralized systems while establishing and governing BVNK's bug bounty programme.

What you'll do

• Design, build, and deploy automated workflows to continuously identify, discover, map, and mitigate security risks across separate business environments and bespoke tools.
• Programmatically orchestrate and streamline complex user access reviews across disconnected internal and external systems that may utilise independent user management interfaces.
• Implement, manage, and scale the company's external bug bounty programme. Act as the primary internal interface to validate crowdsourced findings and track them through to successful remediation.
• Lead the technical risk mapping and operational governance for applicable regulations. Maintain consistent control alignment with the Digital Operational Resilience Act (DORA), MiCA, AI Act, GDPR, AML regulations, and global operational resilience principles by integrating Vanta with other tools and processes.
• Formulate, publish, and maintain information security and operational risk policies that reflect corporate security objectives while integrating newly identified risk vectors, focusing on technical governance for AI and newly emerging threats.
• Administer and optimise automated compliance platforms to manage the internal risk register, monitor control effectiveness, and drive hands-free audit evidence gathering by integrating and extending the capabilities of AI and other technical tools.
• Autonomously lead technical GRC initiatives from scoping through to execution, managing timelines, tracking resource dependencies, and coordinating across cross-functional infrastructure teams.

What you bring

• A Bachelor's degree in Information Security, Computer Science, IT Audit, Risk Management, or equivalent practical experience.
• 2-4 years of experience in technical GRC, IT Audit, Operational Risk Management, or an automation-focused information security or compliance role.
• Exceptional analytical capabilities to isolate operational vulnerabilities within heavily customised environments, third-party software integrations, and decentralized access registers.
• Direct experience managing controls aligned with financial and cybersecurity frameworks, specifically including AML rules, MiCA guidelines, and DORA requirements.
• Skill in translating text-heavy regulatory mandates and manual review processes into programmatic triggers and automated detection mechanisms, implementing AI and other technical tools at scale.
• Strong conceptual understanding of modern infrastructure components such as Amazon AWS, containers (Docker), microservices architecture, and API ecosystems, enabling effective risk oversight in highly technical environments.
• Proven ability to author clear, executive-ready information security policies that bridge engineering workflows with financial-grade compliance obligations.

Nice to have

• Prior exposure to managing or triage coordination for a bug bounty platform such as HackerOne or Bugcrowd, or working closely with external application security researchers.
• Practical familiarity operating automated compliance software like Vanta or equivalent GRC platforms.

What we offer

• Competitive salary of €55,000-€80,000 EUR (based on candidate experience and relevant certifications)
• Flexible working hours with hybrid working at its heart
• A flexible approach to holiday
• Opportunities to travel to offices around the world

About BVNK

BVNK is the stablecoin-powered financial stack for enterprises, now part of Mastercard. You enable businesses to build financial products, unlock new markets, and move money in seconds across 130+ countries with 40+ licenses for fiat and digital assets globally. Trusted by industry leaders like Corpay, Worldpay, Deel, and Flywire, BVNK delivers the infrastructure that makes new forms of money usable within the financial systems customers already rely on today.