About Bitpanda
Bitpanda operates a user-friendly investment platform where customers can invest in cryptocurrencies, crypto indices, stocks, precious metals, and commodities. Its products serve more than 7 million customers across Europe.
Responsibilities
•Own and evolve GRC domains end-to-end, including strategy, annual plans, operating cadences, and success metrics
•Rationalize controls and tailor them to risk, strengthening controls for critical and regulated assets while streamlining low-risk areas
•Facilitate and challenge high-impact risk assessments for new products, major architectural changes, and critical vendors
•Drive risk treatment by aligning owners, negotiating timelines, tracking commitments, and escalating risks above appetite
•Lead complex, multi-entity and regulator-facing audits and assessments, from readiness and walkthroughs through remediation
•Design and run a risk-based control testing program, identify weaknesses, and drive lasting remediation through process improvements, automation, and tooling
•Translate regulatory requirements into structured internal work programs
•Set due diligence and ongoing monitoring requirements for critical suppliers
•Partner with Procurement and Legal on security contract requirements and supply-chain oversight
•Mentor Specialists, Associates, and Senior Associates; set standards for documentation, evidence, and stakeholder engagement
•Help engineering and operations teams implement requirements efficiently and consistently
Requirements
•Typically 6–10 years of experience in information security GRC, audit/assurance, risk management, compliance, or adjacent security roles
•Proven experience leading audits or assessments and driving remediation across multiple teams and systems
•Strong working knowledge of ISO 27001 and DORA, and/or SOC 2, PCI DSS, or NIST
•Ability to design controls, define evidence, and test control effectiveness
•Strong understanding of technology risk across cloud, IAM, SDLC governance, incident management, vulnerability management, logging and monitoring, and third-party risk
•Excellent written and verbal communication skills, including producing executive-ready materials and auditor-facing narratives
Conditions
•Competitive total compensation package aligned with Bitpanda's pay-for-impact policy, including participation in its stock option plan
•Confidential coaching, counselling, and mental health resources through OpenUP
•Three additional paid days off in 2027 after six months with the company
•Unlimited access to Udemy's online course library
•Discounts, rewards, and partner perks across lifestyle, wellness, technology, and travel
•Up to eight additional weeks of gender-neutral new parent leave
•Free onsite dining, including freshly prepared lunches and snacks, for employees in Vienna, Bucharest, Barcelona, and Berlin
•Tenure recognition and rewards, Bitpanda-branded merchandise, and company events
•Additional 25 days per year to work from a city or country of choice
•Hybrid schedule: three days onsite and two days from home; exceptions apply to shift-based teams and roles requiring onsite work
•Applicants must possess an EU passport or a valid work permit authorising work in the hiring location
•Applicants are asked to provide their notice period and annual gross salary expectations and confirm availability for the required hybrid schedule of three office days per week
