information security engineer in fintech

Bitpanda; Wien; Hybrid; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Stock option plan

OpenUP coaching

Udemy course library

Paid parental leave

Job summary

Bitpanda ищет руководителя по GRC и аудиту, чтобы выстроить много‑годовую дорожную карту контроля и управлять процессами аудита и соответствия. Вы будете работать над стратегиями управления рисками, обеспечением доказательств и взаимодействием с регуляторами, включая ISO 27001 и DORA.

Кандидат имеет опыт ведения сложных GRC‑программ, умение влиять на стейкхолдеров и индустриальные знания в области защиты данных и кибербезопасности. Роль предполагает гибридный формат работы с офисами в Европе.

Qualifications

• 7–10+ лет опыта в информационной безопасности GRC, аудите/уверенности, рисках или комплаенсе.
• Глубокие знания ISO 27001 и DORA; знание SOC 2, NIST CSF, BaIT и COBIT.
• Опыт управления мульти‑задачными GRC‑программами и аудиторскими процессами.

Responsibilities

• Определение много-годовой дорожной карты GRC в соответствии с бизнес-стратегией и регуляторными требованиями.
• Развитие контрольной среды: рационализация и устранение дублирования, пропорциональность по критичности и данным.
• Формирование принципов управления и базовых уровней контроля; обеспечение доказательств.
• Консультирование руководства по принятию material risk решений и расстановке приоритетов исправления.
• Создание материалов для регуляторов, руководства и комитетов, с обоснованием.
• Ведение ответов на сложные аудиторские и регуляторные вопросы; корневые причины и программы коррекции.
• Коучинг и наставничество специалистов в ISMS/ISO 27001, DORA, третьест-party риск и т.д.

Skills

GRC leadership

Audit management

ISO 27001

DORA familiarity

Stakeholder influence

Education

BSc/BA in IT Security

Tools

SOC 2

NIST CSF

COBIT

Job description

Описание: Bitpanda operates a trade-everything investment platform that enables more than 7 million customers to invest in cryptocurrencies, crypto indices, stocks, precious metals, and commodities. Headquartered in Austria, it operates across Europe.

Задачи

• Define a multi-year GRC roadmap aligned with business strategy, risk appetite, and regulatory expectations
• Evolve the control framework by rationalizing controls, reducing duplication, and ensuring proportionality based on criticality, data sensitivity, and business impact
• Establish governance principles, including minimum control baselines, exception governance, and evidence-by-design
• Advise leadership on material risk decisions, including risk acceptance, remediation prioritization, control investments, and scope decisions
• Produce executive-grade risk narratives, board and committee materials, and regulator and customer responses with defensible rationale
• Facilitate senior stakeholder alignment when priorities conflict
• Own the strategy and approach for major audits and assurance activities, including ISO 27001, SOC 2, regulatory examinations, and key client due diligence
• Lead responses to complex audit and regulatory issues, including root-cause analysis, corrective action programs, and sustained effectiveness verification
• Serve as an SME in one or more areas: ISMS/ISO 27001 at scale, DORA and operational resilience governance, third-party risk for critical ICT providers, or security control assurance
• Set standards and reusable artifacts, including control narratives, evidence templates, testing methodologies, and playbooks
• Mentor specialists and associates through coaching and review
• Partner with Security Engineering, IT, and Compliance to embed controls into workflows, using policy-to-automation where possible

Требования

• Typically 7–10+ years of experience in information security GRC, audit/assurance, security risk, compliance, software engineering, and/or financial services risk roles
• Demonstrated ownership of complex, multi-stakeholder GRC programs and successful navigation of audits and regulatory scrutiny
• Deep working knowledge of ISO 27001 and DORA, and strong familiarity with SOC 2, NIST CSF, BaIT, and COBIT, including control testing and evidence
• Strong technology risk understanding across cloud, IAM, SDLC governance, incident management, vulnerability management, logging/monitoring, and crypto/fintech operational processes as relevant
• Ability to influence across the organization and resolve conflicts with a risk-based, outcome-oriented approach

Условия

• Competitive total compensation package aligned with Bitpanda’s pay-for-impact policy, including participation in its stock option plan
• Confidential coaching, counselling, and mental health resources through OpenUP
• Three additional paid days off in 2027 after six months with the company
• Unlimited access to Udemy’s online course library
• Discounts, rewards, and perks from partners worldwide across lifestyle, wellness, tech, and travel
• Up to eight additional weeks of gender-neutral new parent leave
• Free onsite dining, freshly prepared lunches, and snacks for employees in Vienna, Bucharest, Barcelona, and Berlin
• Tenure recognition and rewards, Bitpanda-branded merchandise, and company events
• 25 Additional days per year to work from a city or country of choice
• Hybrid model: three days onsite and two days from home; exceptions apply to shift-schedule teams and roles requiring office presence