Information Security Specialist

In dieser Rolle entwickelst du Governance-, Risiko- und Compliance-Programme und gestaltest maßgeblich Risikomanagement-Prozesse, stehst für Audits bereit und optimierst Sicherheitskontrollen in einem regulierten Umfeld., * As an Information Security Specialist, you will own and mature significant parts of our governance, risk, and compliance program in a regulated fintech environment.

• You’ll be the go-to person for one or more GRC domains (e.g., ISMS and ISO 27001, audit & assurance, third-party risk, risk management, regulatory mapping), driving outcomes end-to-end: control design, operationalization with stakeholders, testing, metrics, and continuous improvement.
• You’ll operate with high autonomy, influence across teams, and help shape how we scale security governance as the company grows.
• Own one or more GRC domains (e.g., ISO 27001/ISMS, control testing, TPRM, risk governance, BCM), including yearly plans, cadence, and measurable outcomes.
• Build scalable processes and playbooks that reduce audit friction and improve control consistency across teams/entities.
• Coordinate internal and external audits end-to-end (readiness planning, walkthroughs, evidence strategy, auditor Q&A, remediation verification).
• Translate new regulatory and customer requirements into control impacts, implementation guidance, and tracked delivery plans.
• Draft and quality-review formal materials: audit responses, management action plans, risk acceptances, and control descriptions.
• Facilitate and challenge risk assessments for systems, products, and material changes.
• Ensure consistent scoring and clear treatment decisions.
• Drive risk treatment plans with accountable owners.
• Escalate when timelines or residual risk are not acceptable.
• Improve risk reporting for leadership: themes, systemic issues, KRIs/KPIs, and clear prioritization based on business criticality.
• Lead due diligence for critical vendors: define minimum security requirements, review evidence, and track remediation.
• Partner with Legal/Procurement to embed security requirements into contracts and ensure ongoing oversight (renewals, periodic reviews, SLA/security obligations).
• Design and run a risk-based control testing plan (design and operating effectiveness), ensuring repeatability and traceability.
• Identify recurring control failures and drive cross-functional improvements (e.g., clearer ownership, automation, better tooling, updated standards).
• Introduce automation and dashboards where useful (e.g., evidence collection, control health reporting, risk and audit tracking).

• Strong working knowledge of ISO 27001 (or comparable frameworks) and ability to map requirements to controls, evidence, and real operational processes.
• Security fundamentals across IAM, SDLC governance, incident management, vulnerability management, logging/monitoring, and third-party risk concepts.
• Excellent written communication: can produce policy/control documentation and audit-ready narratives with minimal supervision., * Typically 4-7 years of experience in GRC, audit/assurance, security risk management, compliance, or information security.
• Experience leading audits/assessments or significant parts of them (planning through closure).

• Flexibility to work where you thrive - Enjoy the freedom of our Hybrid working model, combining onsite collaboration and remote work, with an additional 25 days per year to work from a city or country of your choice.
• Receive a competitive total compensation package aligned with Bitpanda’s pay-for-impact policy, including participation in our stock option plan.
• Access confidential coaching, counselling, and mental health resources whenever you need them through OpenUP.
• On top of your standard annual leave, prioritise your wellbeing in 2027 with 3 additional days of paid time off to rest, reset, and recharge, available once you’ve been with us for 6 months.
• Grow your skills and stay ahead in your career with unlimited access to Udemy’s library of online courses at your own pace.
• Enjoy discounts, rewards, and perks from partners worldwide across lifestyle, wellness, tech, and travel.
• Take advantage of up to 8 additional weeks of gender-neutral new parent leave to welcome and bond with your new addition to the family.
• Pandas in Vienna, Bucharest, Barcelona, and Berlin can enjoy free onsite dining, with freshly prepared lunches and snacks to keep you fueled and focused all day long.
• Celebrate milestones and achievements with recognition and rewards for your Tenure at Bitpanda.
• Access exclusive Bitpanda-branded merchandise and gear to represent.
• Join unforgettable company events, from our Winter Party in Vienna to gatherings worldwide, fostering fun, connection, and celebration.