Specialist, Information Security

As an Information Security Specialist at Bitpanda, you will own and mature significant parts of our governance, risk, and compliance program in a regulated fintech environment. You'll become the go-to person for one or more GRC domains such as ISMS and ISO 27001, audit and assurance, third-party risk, risk management, or regulatory mapping. You'll drive outcomes end-to-end: control design, operationalization with stakeholders, testing, metrics, and continuous improvement, operating with high autonomy and influence across teams.

What you'll do

• Own one or more GRC domains such as ISO 27001/ISMS, control testing, TPRM, risk governance, or BCM, including yearly plans, cadence, and measurable outcomes; build scalable processes and playbooks that reduce audit friction and improve control consistency across teams and entities.
• Coordinate internal and external audits end-to-end: readiness planning, walkthroughs, evidence strategy, auditor Q&A, and remediation verification; translate new regulatory and customer requirements into control impacts, implementation guidance, and tracked delivery plans; draft and quality-review formal materials such as audit responses, management action plans, risk acceptances, and control descriptions.
• Facilitate and challenge risk assessments for systems, products, and material changes; ensure consistent scoring and clear treatment decisions; drive risk treatment plans with accountable owners; escalate when timelines or residual risk are not acceptable; improve risk reporting for leadership covering themes, systemic issues, KRIs/KPIs, and clear prioritization based on business criticality.
• Lead due diligence for critical vendors if in your scope: define minimum security requirements, review evidence, and track remediation; partner with Legal and Procurement to embed security requirements into contracts and ensure ongoing oversight through renewals, periodic reviews, and SLA/security obligations.
• Design and run a risk-based control testing plan covering design and operating effectiveness, ensuring repeatability and traceability; identify recurring control failures and drive cross-functional improvements such as clearer ownership, automation, better tooling, or updated standards; introduce automation and dashboards where useful for evidence collection, control health reporting, and risk and audit tracking.

What you bring

• Typically 4-7 years of experience in GRC, audit/assurance, security risk management, compliance, or information security.
• Strong working knowledge of ISO 27001 or comparable frameworks and the ability to map requirements to controls, evidence, and real operational processes.
• Experience leading audits/assessments or significant parts of them from planning through closure.
• Security fundamentals across IAM, SDLC governance, incident management, vulnerability management, logging/monitoring, and third-party risk concepts.
• Excellent written communication: you can produce policy and control documentation and audit-ready narratives with minimal supervision.

What we offer

• Hybrid working model with the flexibility to work onsite and remotely, plus 25 additional days per year to work from a city or country of your choice.
• Competitive total compensation package aligned with our pay-for-impact policy, including participation in our stock option plan.
• Unlimited access to Udemy's library of online courses to grow your skills and stay ahead in your career.
• Confidential coaching, counselling, and mental health resources through OpenUP.
• 3 additional days of paid time off to rest and recharge, available once you've been with us for 6 months.
• Up to 8 additional weeks of gender-neutral new parent leave.
• Free onsite dining with freshly prepared lunches and snacks at our Vienna, Bucharest, Barcelona, and Berlin offices.
• Recognition and rewards for your tenure and achievements at Bitpanda.
• Exclusive Bitpanda-branded merchandise and gear.
• Discounts, rewards, and perks from partners worldwide across lifestyle, wellness, tech, and travel.
• Company events and gatherings worldwide, including our Winter Party in Vienna.
• Additional location-specific benefits.

About Bitpanda

Founded in 2014 in Vienna, Austria, Bitpanda is a user-friendly investment platform serving more than 7 million customers across Europe. We empower both first-time investors and seasoned experts to invest in cryptocurrencies, crypto indices, stocks, precious metals, and commodities 24/7, positioning ourselves as one of Europe's safest and most secure platforms.