Specialist, Information Security

Kurz zusammengefasst

Bitpanda, a Vienna‑based fintech founded in 2014, offers a multi‑asset platform that lets users trade cryptocurrencies, stocks, precious metals and commodities. The company serves more than seven million customers across Europe and positions itself as a secure, modern investing service. The role advertised is Specialist, Information Security, focused on advancing Bitpanda's governance, risk and compliance (GRC) program within this regulated environment. In this position you will take ownership of one or more GRC domains such as ISO 27001/ISMS, control testing, third‑party risk management, risk governance or business continuity. Responsibilities include creating yearly plans, building scalable processes and playbooks, and reducing audit friction. You will also coordinate internal and external audits from readiness planning through evidence collection and remediation verification, translate new regulatory and customer requirements into actionable controls, and draft formal audit responses and risk documentation. Additional duties involve facilitating risk assessments for systems and products, driving risk treatment plans, improving leadership reporting, leading due‑diligence for critical vendors, and designing risk‑based control testing programmes that incorporate automation and dashboards. The role requires a professional with four to seven years of experience in GRC, audit/assurance, security risk management, compliance or information security. A solid understanding of ISO 27001 or comparable frameworks and the ability to map those requirements to controls and evidence is essential. Candidates must have led audits or assessments end‑to‑end, possess security fundamentals across identity and access management, software development lifecycle governance, incident and vulnerability management, logging/monitoring and third‑party risk, and demonstrate excellent written communication for policy and audit‑ready documentation. Preferred qualifications include experience with building scalable GRC processes, introducing automation for evidence collection and reporting, and the ability to work autonomously while influencing cross‑functional teams. The position offers a hybrid working model with the flexibility to work remotely or onsite, plus an additional 25 days per year to work from any city or country. Bitpanda provides a competitive compensation package linked to impact, stock option participation, and access to mental‑wellbeing resources such as coaching and counselling. What the role asks for: - 4‑7 years experience in GRC, audit/assurance, security risk or compliance - Strong working knowledge of ISO 27001 or comparable frameworks - Experience leading audits or assessments from planning to closure - Security fundamentals across IAM, SDLC governance, incident management, vulnerability management, logging/monitoring and third‑party risk - Excellent written communication for policy and audit documentation - Nice‑to‑have: experience building scalable GRC processes and automation - Nice‑to‑have: ability to design risk‑based control testing programmes - Nice‑to‑have: experience with third‑party risk due diligence and contract integration