> Markdown version of [/jobs/ext/4695468-associate-information-security](https://www.wearedevelopers.com/jobs/ext/4695468-associate-information-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Associate, Information Security

- **Company:** Bitpanda GmbH
- **Location:** Wien, Austria (Remote available)
- **Experience:** Expert
- **Contract:** Internship / Graduate position
- **Skills:** Cyber Security, Identity and Access Management, Systems Development Life Cycle, Software Vulnerability Management, Data Logging, Information Security Management System
- **Published:** November 13, 2026
- **Apply:** https://job-boards.eu.greenhouse.io/bitpanda/jobs/5034977101

## About the Role

* 2-4 years of experience in GRC, audit, security risk management, or compliance.
 * Strong knowledge of ISO 27001 (or similar frameworks) and the ability to map requirements to real operational processes.
 * Hands-on experience coordinating audits or risk assessments from planning through closure.
 * Solid grasp of security fundamentals (IAM, SDLC, incident and vulnerability management, logging/monitoring, third-party risk).
 * Excellent communication skills: can independently produce clear policy documentation, audit narratives, and manage stakeholder relationships.

## Description

As an Information Security Senior Associate, you will execute and mature key parts of our GRC program in a regulated fintech environment. You'll take charge of specific GRC domains (e.g., ISMS/ISO 27001, audit, risk management, TPRM), driving control design, testing, and cross-functional coordination. Operating with strong autonomy, you'll bridge high-level strategy and daily operations to help scale our security governance.

What you'll do

 * GRC domain execution: Manage daily operations of assigned GRC domains, track yearly plans, and build scalable playbooks to reduce audit friction and improve control consistency.
 * Assurance & audits: Coordinate internal and external audits end-to-end (planning, evidence gathering, auditor Q&A, remediation). Translate regulatory requirements into actionable plans and draft formal audit responses.
 * Risk management: Facilitate risk assessments for systems and products. Drive treatment plans with owners, escalate unacceptable residual risks, and prepare clear KRI/KPI reporting for leadership.
 * Third-party risk management (if in scope): Drive vendor due diligence by evaluating security evidence and tracking remediation. Partner with Legal and Procurement to embed security obligations into contracts.
 * Control testing & improvement: Execute risk-based control testing (design and operating effectiveness). Identify recurring failures, propose process upgrades, and implement dashboards for evidence collection.