Expert, Information Security

Kurz zusammengefasst

Bitpanda, a Vienna‑based fintech founded in 2014, provides a user‑friendly platform that lets millions of customers across Europe trade cryptocurrencies, stocks, precious metals and commodities. The company positions itself as a secure, modern investing service and operates with a globally distributed team. The opening role is for an **Expert, Information Security**, a senior individual contributor who will shape and execute the firm's governance, risk and compliance (GRC) strategy within a regulated financial‑technology environment. In day‑to‑day work the expert will define a multi‑year GRC roadmap that aligns with business goals, risk appetite and regulatory expectations such as DORA readiness. They will refine the control framework, eliminate redundancies and set "north star" governance principles. The role also involves advising senior leadership on material risk decisions, preparing executive‑level risk narratives, board materials and regulator responses, and mediating conflicts between delivery speed and control rigor. The expert will own the strategy for major audits and assurance activities, including ISO 27001, SOC 2, regulatory examinations and key client due diligence, leading scope definition, negotiation and remediation programs. Depending on need, they may act as the subject‑matter expert for areas such as ISMS/ISO 27001 at scale, DORA operational resilience, third‑party risk for critical ICT providers, or security control assurance. Additionally, they will create reusable standards, templates and playbooks, mentor junior staff and collaborate with Security Engineering, IT and Compliance to embed controls into workflows. The position requires a seasoned professional with **seven to ten plus years** of experience in information‑security GRC, audit, risk, compliance, software engineering or financial‑services risk roles. Candidates must have a proven record of owning complex, multi‑stakeholder GRC programmes and navigating rigorous audits or regulatory scrutiny. Deep, hands‑on knowledge of **ISO 27001** and **DORA** is essential, together with solid familiarity with related frameworks such as **SOC 2, NIST CSF, BaIT and COBIT**. A strong grasp of technology risk, covering cloud environments, identity‑and‑access‑management, software‑development‑life‑cycle governance, incident and vulnerability management, as well as logging, monitoring and fintech operational processes, is also required. The ability to influence across the organisation and resolve conflicts using a risk‑based, outcome‑oriented approach is a key personal attribute. Bitpanda offers a hybrid working model that lets employees split time between office collaboration and remote work, plus an extra 25 days per year to work from any city or country of choice. Compensation is competitive and tied to impact, featuring a stock‑option plan. The role sits within a fast‑moving, "roll‑up‑your‑sleeves" culture that values diverse perspectives and rapid innovation, providing ample opportunity to make a high‑visibility impact from day one. What the role asks for: - 7+ years experience in information‑security GRC or related risk roles - Proven ownership of complex multi‑stakeholder GRC programmes - Deep knowledge of ISO 27001 framework - Knowledge of DORA regulatory requirements - Familiarity with SOC 2 standards - Familiarity with NIST CSF framework - Familiarity with BaIT framework - Familiarity with COBIT framework - Strong understanding of cloud and IAM technology risks - Ability to influence across the organisation and resolve conflicts