SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Bitpanda is a fintech platform founded in 2014 that simplifies wealth creation by enabling users to invest in cryptocurrencies, crypto indices, stocks, precious metals, and commodities. Operating across Europe with 7+ million customers, Bitpanda is one of Europe's safest and most secure investment platforms.
As an Information Security Expert, you are a senior individual contributor who sets direction and solves complex GRC (Governance, Risk, and Compliance) problems in a regulated fintech environment. You will shape security governance strategy, ensure the control framework remains effective as the business scales, and act as a key advisor to security leadership and senior business stakeholders on risk and compliance decisions. You'll lead complex, high-impact initiatives spanning multiple entities and regions, influence across the organization, and raise the bar for how security controls are designed, tested, and evidenced.
Key responsibilities include:
**GRC Strategy & Roadmap:** Define multi-year GRC roadmap aligned to business strategy, risk appetite, and regulatory expectations (e.g., DORA readiness, audit strategy, control maturity targets). Drive control framework evolution by rationalizing controls, reducing duplication, and ensuring proportionality based on criticality, data sensitivity, and business impact. Establish governance principles such as minimum control baselines, exception governance, and evidence-by-design.
**Executive Advisory & Decision Support:** Advise leadership on material risk decisions including risk acceptance, remediation prioritization, control investments, and scope decisions. Produce executive-grade outputs such as risk narratives, board/committee materials, and regulator/customer responses with defensible rationale. Facilitate senior stakeholder alignment when priorities conflict between delivery speed and control rigor, or cost and assurance depth.
**Regulatory, Audit & Assurance Leadership:** Own strategy and approach for major audits and assurance activities (ISO 27001, SOC 2, regulatory examinations, key client due diligence), including scope, positioning, and negotiation. Lead responses to complex audit and regulatory issues through root-cause analysis, corrective action programs, and sustained effectiveness verification.
**Domain SME Ownership:** Serve as subject matter expert for one or more areas: ISMS/ISO 27001 at scale (multi-entity scope, continuous compliance); DORA and operational resilience governance (control mapping, ICT risk integration, testing oversight); third-party risk for critical ICT providers (oversight model, ongoing monitoring, exit/continuity governance); or security control assurance (testing program design, evidence standards, control health metrics).
**Enablement, Standards & Mentorship:** Set standards and create reusable artifacts including control narratives, evidence templates, testing methodologies, and playbooks. Mentor specialists and associates to raise organization-wide capability through coaching and review. Partner with Security Engineering, IT, and Compliance teams to embed controls into workflows, automating where possible.
Bitpanda offers hybrid flexibility with 25 additional days per year to work from a city or country of your choice, competitive total compensation aligned with pay-for-impact policy including stock options, mental health support through OpenUP, unlimited Udemy access, and location-specific benefits including free onsite dining in Vienna, Bucharest, Barcelona, and Berlin.
**Requirements:**
- Typically 7–10+ years of experience in information security GRC, audit/assurance, security risk, compliance, software engineering, and/or financial services risk roles
- Demonstrated ownership of complex, multi-stakeholder GRC programs and successful navigation of audits and regulatory scrutiny
- Deep working knowledge of ISO 27001 and DORA with strong familiarity of adjacent frameworks (SOC 2, NIST CSF, BaIT, COBIT), including how to test and evidence controls
- Strong technology risk understanding across cloud, IAM, SDLC governance, incident management, vulnerability management, logging/monitoring, and crypto/fintech operational processes as relevant
- Ability to influence across the organization and resolve conflicts with a risk-based, outcome-oriented approach
