Senior Information Security & GRC Leader

Bitpanda; Barcelona; Hybrid; EUR 110,000 - 160,000; Full time

Benefits offered by this job

Stock options

Hybrid work model

OpenUP mental wellbeing resources

Udemy learning access

Additional paid leave for new parents

Job summary

Bitpanda is seeking an Information Security Expert to lead governance, risk, and compliance efforts across our fintech operations. You will set the direction for the GRC program, shape security governance and risk management, and advise senior stakeholders on risk decisions with clear, evidence-based narratives.

You will drive complex, multi‑region initiatives, collaborate with security leadership, and mentor teams to raise the standard of control testing, evidence collection, and regulatory

Qualifications

• Typically 7–10+ years of experience in information security GRC, audit/assurance, security risk, compliance, or related roles.
• Experience navigating audits/regulatory scrutiny in fintech or financial services.
• Strong understanding of governance, risk management, and regulatory controls.

Responsibilities

• Define multi‑year GRC roadmap aligned with business strategy and regulatory expectations.
• Advise leadership on risk decisions with defensible risk narratives and board materials.
• Own strategy for major audits and regulatory examinations, including scoping and responses.
• Lead domain SME activities for ISMS/ISO 27001, DORA, and related frameworks.
• Mentor teams and embed control practices into workflows with policy-to-automation where possible.

Skills

Information security GRC

Audit & Assurance

Security risk

Compliance

Software engineering

Financial services risk

Job description

Bitpanda is seeking an Information Security Expert to lead governance, risk, and compliance efforts across our fintech operations. You will set the direction for the GRC program, shape security governance and risk management, and advise senior stakeholders on risk decisions with clear, evidence-based narratives.

You will drive complex, multi‑region initiatives, collaborate with security leadership, and mentor teams to raise the standard of control testing, evidence collection, and regulatory