GRC & Information Security Specialist

Bitpanda GmbH; Wien; Hybrid; EUR 85,000 - 120,000; Full time

Benefits offered by this job

Hybrid working model

Stock options

OpenUP mental health resources

Udemy courses access

Extra paid time off

Job summary

Bitpanda is seeking an Information Security Specialist in Vienna to mature governance, risk, and compliance programs in a regulated fintech environment. You will own GRC domains, drive audits, and shape how security governance scales as the company grows.

You will operate with high autonomy across teams, influence stakeholders, and contribute to continuous improvement in control testing, risk reporting, and third‑party risk management. Hybrid work with global benefits are offered.

Qualifications

• 4–7 years in GRC, audit/assurance, or info security.
• Strong ISO 27001 knowledge and mapping requirements to controls.
• Experience leading audits from planning to closure.
• Security fundamentals across IAM, SDLC governance, incidents, vulnerabilities.
• Excellent written policy/documentation skills.

Responsibilities

• GRC domain ownership & program maturity across ISO 27001/ISMS, audits, and risk governance.
• Coordinate internal and external audits end‑to‑end with remediation verification.
• Lead risk assessments for systems, products, and changes; drive risk treatment plans.
• Lead due diligence for third‑party risk management and vendor oversight.
• Design and run a control testing plan with automation and dashboards.

Skills

GRC expertise

ISO 27001 knowledge

Audit leadership

Risk management

Third-party risk

Tools

IAM

SIEM

Vulnerability management

Incident management

Job description

Bitpanda is seeking an Information Security Specialist in Vienna to mature governance, risk, and compliance programs in a regulated fintech environment. You will own GRC domains, drive audits, and shape how security governance scales as the company grows.

You will operate with high autonomy across teams, influence stakeholders, and contribute to continuous improvement in control testing, risk reporting, and third‑party risk management. Hybrid work with global benefits are offered.