SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Bitpanda is a fintech platform founded in 2014 that simplifies wealth creation by enabling users to invest in cryptocurrencies, crypto indices, stocks, precious metals, and commodities. Serving over 7 million customers across Europe, the company operates from Vienna with a global team.
As an Information Security Specialist, you will own and mature significant parts of the governance, risk, and compliance (GRC) program in this regulated fintech environment. You'll be the go-to person for one or more GRC domains—such as ISMS and ISO 27001, audit & assurance, third-party risk, risk management, or regulatory mapping—driving outcomes end-to-end from control design through operationalization, testing, metrics, and continuous improvement.
Key responsibilities include:
**GRC Domain Ownership & Program Maturity**: Own one or more GRC domains with yearly plans, cadence, and measurable outcomes. Build scalable processes and playbooks that reduce audit friction and improve control consistency across teams and entities.
**Assurance, Audits & Regulatory Readiness**: Coordinate internal and external audits end-to-end, including readiness planning, walkthroughs, evidence strategy, and auditor Q&A. Translate new regulatory and customer requirements into control impacts and implementation guidance. Draft and quality-review formal materials such as audit responses, management action plans, risk acceptances, and control descriptions.
**Risk Management & Decision Support**: Facilitate and challenge risk assessments for systems, products, and material changes. Ensure consistent scoring and clear treatment decisions. Drive risk treatment plans with accountable owners and escalate when timelines or residual risk are unacceptable. Improve risk reporting for leadership with themes, systemic issues, KRIs/KPIs, and clear prioritization.
**Third-Party Risk Management** (if in scope): Lead due diligence for critical vendors by defining minimum security requirements, reviewing evidence, and tracking remediation. Partner with Legal and Procurement to embed security requirements into contracts and ensure ongoing oversight.
**Control Testing & Continuous Improvement**: Design and run a risk-based control testing plan covering design and operating effectiveness. Identify recurring control failures and drive cross-functional improvements. Introduce automation and dashboards for evidence collection, control health reporting, and risk/audit tracking.
You will operate with high autonomy, influence across teams, and help shape how the company scales security governance as it grows.
**Requirements**
- Typically 4–7 years of experience in GRC, audit/assurance, security risk management, compliance, or information security.
- Strong working knowledge of ISO 27001 (or comparable frameworks) and ability to map requirements to controls, evidence, and real operational processes.
- Experience leading audits/assessments or significant parts of them (planning through closure).
- Security fundamentals across IAM, SDLC governance, incident management, vulnerability management, logging/monitoring, and third-party risk concepts.
- Excellent written communication: ability to produce policy/control documentation and audit-ready narratives with minimal supervision.
