Senior Information Security & GRC Leader - FinTech

Neobankbeat; Barcelona; Hybrid; EUR 110,000 - 150,000; Full time

Benefits offered by this job

Stock options

Hybrid work

Udemy access

3 extra PTO days

OpenUP coaching

Onsite dining

Job summary

Bitpanda is seeking an experienced Information Security GRC Lead to shape governance, risk and compliance in a regulated fintech environment. You will drive the GRC roadmap, lead audits (ISO 27001, SOC 2) and partner with security leadership on risk-based decisions across multiple regions.

You will influence policy, map controls, and deliver executive materials for boards and regulators, while mentoring teams to raise the organisation's security posture in a fast-moving, hybrid-work setting.

Qualifications

• 7–10+ years in information security GRC, audit, risk, or compliance.
• Proven ownership of multi-stakeholder GRC programs and audits.
• Deep knowledge of ISO 27001, DORA, SOC 2, NIST CSF; testing/evidence of controls.

Responsibilities

• Define multi-year GRC roadmap aligned to strategy and regulatory expectations.
• Lead control framework evolution and evidence-based governance.
• Advise senior leadership on risk decisions and register executive outputs.
• Own strategy for audits and regulatory examinations and respond to issues.
• Be SME for ISMS/ISO 27001, DORA, and third-party risk where needed.
• Mentor teams and embed controls into security/IT workflows.

Skills

GRC strategy

Audit leadership

Regulatory compliance

Risk management

Stakeholder management

ISO 27001

DORA familiarity

SOC 2 familiarity

NIST CSF

Cloud security

Education

Bachelor's in CS/IS/related

Job description

Bitpanda is seeking an experienced Information Security GRC Lead to shape governance, risk and compliance in a regulated fintech environment. You will drive the GRC roadmap, lead audits (ISO 27001, SOC 2) and partner with security leadership on risk-based decisions across multiple regions.

You will influence policy, map controls, and deliver executive materials for boards and regulators, while mentoring teams to raise the organisation's security posture in a fast-moving, hybrid-work setting.