Senior Specialist, Information Security

As a Senior Specialist in Information Security at Bitpanda, you lead and scale major elements of security governance in a regulated fintech environment. You own complex, cross-functional GRC domains such as ISMS/ISO 27001 at scale, regulatory readiness, enterprise technology risk, and third-party risk for critical vendors. You drive measurable improvement in control effectiveness and act as a trusted advisor to senior stakeholders.

What you'll do

• Own and evolve one or more GRC domains end-to-end, such as ISMS operations or BCM, including strategy, annual plan, cadences, and success metrics. Drive control rationalization and proportionality by tightening controls for critical and regulated assets while streamlining low-risk areas to ensure an efficient, risk-aligned posture.
• Facilitate and challenge high-impact risk assessments for new products, major architectural changes, and critical vendors, ensuring consistency and defensible rationale. Drive risk treatment at scale by aligning owners, negotiating timelines, tracking commitments, and escalating where residual risk remains above appetite.
• Lead complex audits and assessments end-to-end, including multi-entity and regulator-facing work. Design and run a risk-based control testing program to identify weaknesses and drive durable remediation through process fixes, automation, and tooling while translating regulatory requirements into structured internal work programs.
• Set due diligence depth and ongoing monitoring requirements for critical suppliers such as cloud, payments, identity, and SaaS providers. Partner with Procurement and Legal on security contract requirements to ensure enforceable obligations and measurable oversight across the supply chain.
• Mentor Specialists, Associates, and Senior Associates. Set quality standards for documentation, evidence, and stakeholder engagement. Act as a GRC translator for engineering and operations teams, helping them implement requirements efficiently and consistently across the organization.

What you bring

• Typically 6 to 10 years of experience in information security GRC, audit and assurance, risk management, compliance, or adjacent security roles.
• A proven track record leading audits and assessments while driving remediation across multiple teams and systems.
• Strong working knowledge of ISO 27001 and DORA, with ability to design controls, define evidence, and test effectiveness. Experience with SOC 2, PCI DSS, or NIST is valuable.
• A strong understanding of technology risk across cloud, IAM, SDLC governance, incident management, vulnerability management, logging and monitoring, and third-party risk.
• Excellent written and verbal communication skills, with the ability to produce executive-ready materials and auditor-facing narratives.

What we offer

• A hybrid working model with the flexibility to work onsite and remotely, plus 25 additional days per year to work from a city or country of your choice.
• Competitive total compensation aligned with Bitpanda's pay-for-impact policy, including participation in the stock option plan.
• Confidential coaching, counselling, and mental health resources through OpenUP.
• 3 additional days of paid time off beyond standard annual leave to rest and recharge, available after 6 months with the company.
• Unlimited access to Udemy's online course library for continuous learning and skill development.
• Discounts, rewards, and perks from partners worldwide across lifestyle, wellness, tech, and travel.
• Up to 8 additional weeks of gender-neutral new parent leave.
• Free onsite dining at our Vienna, Bucharest, Barcelona, and Berlin offices, featuring freshly prepared lunches and snacks.
• Recognition and rewards for tenure and contributions at Bitpanda.
• Exclusive Bitpanda-branded merchandise and gear.
• Company events throughout the year, from the Winter Party in Vienna to gatherings worldwide.

About Bitpanda

Founded in 2014 in Vienna, Austria, Bitpanda is a user-friendly investment platform serving more than 7 million customers. You can trade cryptocurrencies, crypto indices, stocks, precious metals, and commodities, 24/7 with any budget. The company operates across Europe and is recognised as one of the continent's safest and most secure investment platforms.