GRC Security Associate - Fintech (Hybrid, Stock Options)

Bitpanda GmbH; Wien; Hybrid; EUR 70,000 - 100,000; Full time

Benefits offered by this job

Hybrid work model

Stock options

OpenUP mental wellbeing resources

Udemy course access

Extra paid time off

New parent leave

Onsite meals in offices

Company events and branded merch

Job summary

Bitpanda GmbH in Vienna seeks an Information Security Senior Associate to advance key parts of our GRC program in a regulated fintech environment. You will own specific domains like ISMS/ISO 27001, audits, risk management and vendor due diligence, bridging strategy and daily operations with autonomy.

You will coordinate audits, run risk assessments, craft policy documentation, and build scalable controls while collaborating with Legal, Procurement and Security teams.

Qualifications

• 2–4 years of experience in GRC, audit, security risk management, or compliance.
• Strong knowledge of ISO 27001 and mapping requirements to processes.
• Hands-on experience coordinating audits or risk assessments from planning to closure.
• Good grasp of security fundamentals (IAM, SDLC, incidents, vulnerabilities).
• Excellent communication skills for policy docs, audit narratives and stakeholder relations.

Responsibilities

• GRC domain execution: manage daily operations, plan yearly work, build scalable playbooks.
• Assurance & audits: coordinate internal/external audits end‑to‑end and draft responses.
• Risk management: run risk assessments, drive treatment plans, report KRIs/KPIs.
• Third‑party risk management: vendor due diligence and contract security obligations.
• Control testing & improvement: test controls, identify failures, implement dashboards.

Skills

GRC

Audit coordination

ISO 27001

Risk management

IAM

SDLC

Incident management

Vulnerability management

Stakeholder communication

Job description

Bitpanda GmbH in Vienna seeks an Information Security Senior Associate to advance key parts of our GRC program in a regulated fintech environment. You will own specific domains like ISMS/ISO 27001, audits, risk management and vendor due diligence, bridging strategy and daily operations with autonomy.

You will coordinate audits, run risk assessments, craft policy documentation, and build scalable controls while collaborating with Legal, Procurement and Security teams.