Specialist, Information Security

As an Information Security Specialist at Bitpanda, you will own and mature significant parts of our governance, risk, and compliance program in a regulated fintech environment. You'll become the go-to person for one or more GRC domains such as ISMS and ISO 27001, audit and assurance, third-party risk, risk management, or regulatory mapping, driving outcomes end-to-end from control design through operationalization, testing, metrics, and continuous improvement. You'll operate with high autonomy, influence across teams, and help shape how we scale security governance as the company grows.

What you'll do

• Own one or more GRC domains including ISO 27001/ISMS, control testing, TPRM, risk governance, or BCM, developing yearly plans, cadence, and measurable outcomes, and building scalable processes and playbooks that reduce audit friction and improve control consistency across teams and entities
• Coordinate internal and external audits end-to-end, including readiness planning, walkthroughs, evidence strategy, auditor Q&A, and remediation verification; translate new regulatory and customer requirements into control impacts and implementation guidance; draft and quality-review formal materials such as audit responses, management action plans, risk acceptances, and control descriptions
• Facilitate and challenge risk assessments for systems, products, and material changes, ensure consistent scoring and clear treatment decisions, drive risk treatment plans with accountable owners, and escalate when timelines or residual risk are unacceptable; improve risk reporting for leadership covering themes, systemic issues, KRIs/KPIs, and clear prioritization based on business criticality
• Lead due diligence for critical vendors by defining minimum security requirements, reviewing evidence, and tracking remediation; partner with Legal and Procurement to embed security requirements into contracts and ensure ongoing oversight through renewals, periodic reviews, and SLA/security obligation monitoring
• Design and run a risk-based control testing plan covering design and operating effectiveness, ensuring repeatability and traceability; identify recurring control failures and drive cross-functional improvements such as clearer ownership, automation, better tooling, and updated standards; introduce automation and dashboards where useful for evidence collection, control health reporting, and risk and audit tracking

What you bring

• Typically 4-7 years of experience in GRC, audit/assurance, security risk management, compliance, or information security
• Strong working knowledge of ISO 27001 or comparable frameworks, with the ability to map requirements to controls, evidence, and real operational processes
• Experience leading audits or assessments or significant parts of them from planning through closure
• Security fundamentals across IAM, SDLC governance, incident management, vulnerability management, logging/monitoring, and third-party risk concepts
• Excellent written communication skills and ability to produce policy and control documentation and audit-ready narratives with minimal supervision

What we offer

• Hybrid working model with the freedom to work onsite or remotely, plus an additional 25 days per year to work from a city or country of your choice
• Competitive total compensation package aligned with Bitpanda's pay-for-impact policy, including participation in the stock option plan
• Confidential coaching, counselling, and mental health resources through OpenUP
• 3 additional days of paid time off beyond standard annual leave to rest and recharge, available after 6 months of employment
• Unlimited access to Udemy's library of online courses for continuous learning and skill development
• Discounts, rewards, and perks from partners worldwide across lifestyle, wellness, tech, and travel
• Up to 8 additional weeks of gender-neutral new parent leave
• Free onsite dining with freshly prepared lunches and snacks at our Vienna, Bucharest, Barcelona, and Berlin offices
• Recognition and rewards for tenure and achievements at Bitpanda
• Exclusive Bitpanda-branded merchandise and gear
• Company events throughout the year, from the Winter Party in Vienna to gatherings worldwide
• Location-specific benefits designed to make life at Bitpanda rewarding wherever you are

About Bitpanda

Bitpanda, founded in 2014 in Vienna, Austria, simplifies wealth creation by empowering both first-time investors and seasoned experts to invest in cryptocurrencies, crypto indices, stocks, precious metals, and commodities 24/7. Serving more than 7 million customers across Europe, Bitpanda is one of Europe's safest and most secure platforms for modern investing, with teams operating across different cultures and time zones worldwide.