SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Bitpanda is a fintech platform founded in 2014 that simplifies wealth creation by enabling users to invest in cryptocurrencies, crypto indices, stocks, precious metals, and commodities. Operating across Europe with over 7 million customers, Bitpanda is one of Europe's safest and most secure investment platforms.
As a Senior Specialist in Information Security, you will lead and scale major elements of security governance in this regulated fintech environment. You will own complex, cross-functional GRC (Governance, Risk, and Compliance) domains such as ISMS/ISO 27001 at scale, regulatory readiness, enterprise technology risk, third-party risk management for critical vendors, and compliance in key partnerships. You will drive measurable improvements in control effectiveness and act as a trusted advisor to senior stakeholders.
Key responsibilities include:
**Information Security Operating Model & GRC Ownership:** Own and evolve one or more GRC domains end-to-end (e.g., ISMS operations, business continuity management, risk governance), including strategy, annual planning, cadences, and success metrics. Drive control rationalization and proportionality by tightening controls for critical/regulated assets and streamlining low-risk areas to ensure an efficient, risk-aligned security posture.
**Risk Management & Strategic Decision Support:** Facilitate and challenge high-impact risk assessments for new products, major architectural changes, and critical vendors, ensuring consistency and defensible rationale. Drive risk treatment at scale by aligning owners, negotiating timelines, tracking commitments, and escalating where residual risk exceeds appetite.
**Audit, Assurance & Continuous Control Testing:** Lead complex audits and assessments end-to-end, including multi-entity and regulator-facing engagements. Design and run a risk-based control testing program to identify weaknesses and drive durable remediation through process fixes, automation, and tooling. Translate regulatory requirements into structured internal work programs.
**Third-Party Risk & Critical Supplier Oversight:** Set due diligence depth and ongoing monitoring requirements for critical suppliers (cloud, payments, identity, SaaS). Partner with Procurement and Legal on security contract requirements to ensure enforceable obligations and measurable oversight across the supply chain.
**Enablement & Leadership through Others:** Mentor Specialists, Associates, and Senior Associates. Set quality standards for documentation, evidence, and stakeholder engagement. Act as a "GRC translator" for engineering and operations teams, helping them implement requirements efficiently and consistently.
Bitpanda offers hybrid working with flexibility to work from a city or country of your choice for 25 days per year, competitive total compensation aligned with a pay-for-impact policy, stock option participation, mental health support through OpenUP, 3 additional paid days off (after 6 months), unlimited Udemy access, partner discounts and rewards, up to 8 weeks of gender-neutral parental leave, free onsite dining in Vienna/Bucharest/Barcelona/Berlin, tenure recognition, branded merchandise, and company events.
**Requirements:**
- Typically 6–10 years of experience in information security GRC, audit/assurance, risk management, compliance, or adjacent security roles
- Proven track record leading audits/assessments and driving remediation across multiple teams and systems
- Strong working knowledge of ISO 27001 and DORA (and/or SOC 2, PCI DSS, NIST) with ability to design controls, define evidence, and test effectiveness
- Strong understanding of technology risk across cloud, IAM, SDLC governance, incident management, vulnerability management, logging/monitoring, and third-party risk
- Excellent written and verbal communication skills; ability to produce executive-ready materials and auditor-facing narratives
