GRC & Information Security Lead

Bitpanda; Wien; Hybrid; EUR 70,000 - 100,000; Full time

Benefits offered by this job

Hybrid working model

Stock option plan

OpenUP wellbeing resources

Udemy courses access

3 extra days off (2027)

Onsite dining and team events

Job summary

Bitpanda is seeking an Information Security Specialist to own and mature significant parts of our governance, risk, and compliance program in a regulated fintech environment. You’ll drive control design, testing, and regulatory readiness across ISO 27001/ISMS, audits, and third-party risk, with high autonomy as the company scales.

Join a hybrid, globally distributed team. You’ll collaborate with Legal, Procurement, and Security, shaping security governance and risk reporting while benefiting

Qualifications

• Typically 4–7 years of experience in GRC, audit/assurance, security risk management, compliance, or information security.
• Strong working knowledge of ISO 27001 (or comparable frameworks) and mapping requirements to controls and evidence.
• Experience leading audits/assessments from planning through closure.

Responsibilities

• Own one or more GRC domains and drive program maturity with annual plans and measurable outcomes.
• Coordinate internal and external audits end-to-end, and translate requirements into control activities.
• Facilitate risk assessments, ensure consistent scoring, and drive risk treatment plans.
• Lead due diligence for key vendors and embed security requirements into contracts.
• Design and run a risk-based control testing plan with cross-functional improvements.

Skills

GRC ownership

ISO 27001 / ISMS

Audits & assurance

Risk management

Third-party risk

Control testing

Security governance

IAM & SDLC governance

Job description

Bitpanda is seeking an Information Security Specialist to own and mature significant parts of our governance, risk, and compliance program in a regulated fintech environment. You’ll drive control design, testing, and regulatory readiness across ISO 27001/ISMS, audits, and third-party risk, with high autonomy as the company scales.

Join a hybrid, globally distributed team. You’ll collaborate with Legal, Procurement, and Security, shaping security governance and risk reporting while benefiting