Lead, Information Security

About the role

As a senior individual contributor, you will shape Bitpanda’s security governance strategy, ensure the control framework scales with the business, and advise leadership on risk and compliance decisions in a regulated fintech environment.

Key responsibilities

• Define and drive a multi‑year GRC roadmap aligned with business strategy, risk appetite and regulatory expectations such as DORA.
• Advise senior leadership on risk acceptance, remediation prioritisation, and control investments, producing executive‑grade risk narratives and board materials.
• Own strategy and execution for major audits and assurance activities (ISO 27001, SOC 2, regulatory examinations), including scope definition and response to audit findings.
• Serve as subject‑matter expert for domains such as ISMS/ISO 27001, DORA operational resilience, third‑party ICT risk, and security control assurance.
• Set standards, reusable artifacts and playbooks; mentor specialists and embed controls into security engineering and IT workflows.

Required profile

• 7‑10+ years of experience in information security GRC, audit/assurance, security risk, compliance or financial services risk.
• Proven ownership of complex, multi‑stakeholder GRC programmes and successful navigation of audits and regulatory scrutiny.
• Deep knowledge of ISO 27001, DORA and familiarity with SOC 2, NIST CSF, BaIT, COBIT.
• Strong understanding of technology risk across cloud, IAM, SDLC governance, incident and vulnerability management, logging/monitoring and fintech operational processes.

Required skills

• ISO 27001
• DORA
• SOC 2
• NIST CSF
• BaIT
• COBIT
• Cloud security
• Identity and Access Management (IAM)
• Software Development Life Cycle (SDLC) governance
• Incident management
• Vulnerability management
• Logging and monitoring
• Fintech/crypto operational risk

What we offer

• Hybrid working model with flexibility to work remotely or onsite.
• Competitive total compensation, including stock option plan.
• Mental wellbeing support through confidential coaching and counselling.
• Additional paid time off and unlimited Udemy learning access.
• Onsite dining, exclusive perks, parental leave and global team events.