> Markdown version of [/jobs/ext/3692898-information-security-specialist](https://www.wearedevelopers.com/jobs/ext/3692898-information-security-specialist). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Information Security Specialist

- **Company:** Bitpanda GmbH
- **Location:** Wien, Austria (Remote available)
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Cyber Security, Identity and Access Management, Systems Development Life Cycle, Software Vulnerability Management, Data Logging, Information Security Management System
- **Published:** October 12, 2026
- **Apply:** https://devjobs.at/job/260f5fa855821473e185f8025b48631b

## About the Role

* Strong working knowledge of ISO 27001 (or comparable frameworks) and ability to map requirements to controls, evidence, and real operational processes.
 * Security fundamentals across IAM, SDLC governance, incident management, vulnerability management, logging/monitoring, and third-party risk concepts.
 * Excellent written communication: can produce policy/control documentation and audit-ready narratives with minimal supervision., * Typically 4-7 years of experience in GRC, audit/assurance, security risk management, compliance, or information security.
 * Experience leading audits/assessments or significant parts of them (planning through closure).

## Description

In dieser Rolle entwickelst du Governance-, Risiko- und Compliance-Programme und gestaltest maßgeblich Risikomanagement-Prozesse, stehst für Audits bereit und optimierst Sicherheitskontrollen in einem regulierten Umfeld., * As an Information Security Specialist, you will own and mature significant parts of our governance, risk, and compliance program in a regulated fintech environment.

 * You'll be the go-to person for one or more GRC domains (e.g., ISMS and ISO 27001, audit & assurance, third-party risk, risk management, regulatory mapping), driving outcomes end-to-end: control design, operationalization with stakeholders, testing, metrics, and continuous improvement.
 * You'll operate with high autonomy, influence across teams, and help shape how we scale security governance as the company grows.
 * Own one or more GRC domains (e.g., ISO 27001/ISMS, control testing, TPRM, risk governance, BCM), including yearly plans, cadence, and measurable outcomes.
 * Build scalable processes and playbooks that reduce audit friction and improve control consistency across teams/entities.
 * Coordinate internal and external audits end-to-end (readiness planning, walkthroughs, evidence strategy, auditor Q&A, remediation verification).
 * Translate new regulatory and customer requirements into control impacts, implementation guidance, and tracked delivery plans.
 * Draft and quality-review formal materials: audit responses, management action plans, risk acceptances, and control descriptions.
 * Facilitate and challenge risk assessments for systems, products, and material changes.
 * Ensure consistent scoring and clear treatment decisions.
 * Drive risk treatment plans with accountable owners.
 * Escalate when timelines or residual risk are not acceptable.
 * Improve risk reporting for leadership: themes, systemic issues, KRIs/KPIs, and clear prioritization based on business criticality.
 * Lead due diligence for critical vendors: define minimum security requirements, review evidence, and track remediation.
 * Partner with Legal/Procurement to embed security requirements into contracts and ensure ongoing oversight (renewals, periodic reviews, SLA/security obligations).
 * Design and run a risk-based control testing plan (design and operating effectiveness), ensuring repeatability and traceability.
 * Identify recurring control failures and drive cross-functional improvements (e.g., clearer ownership, automation, better tooling, updated standards).
 * Introduce automation and dashboards where useful (e.g., evidence collection, control health reporting, risk and audit tracking).