Specialist, Information Security
Bitpanda, Barcelona, Spain +7
What you will do
- GRC domain ownership & program maturity: Own one or more GRC domains (e.g., ISO 27001/ISMS, control testing, TPRM, risk governance, BCM), including yearly plans, cadence, and measurable outcomes; Build scalable processes and playbooks that reduce audit friction and improve control consistency across teams/entities.
- Assurance, audits & regulatory readiness: Coordinate internal and external audits end-to-end (readiness planning, walkthroughs, evidence strategy, auditor Q&A, remediation verification); translate new regulatory and customer requirements into control impacts, implementation guidance, and tracked delivery plans; draft and quality-review formal materials: audit responses, management action plans, risk acceptances, and control descriptions.
- Risk management & decision support: Facilitate and challenge risk assessments for systems, products, and material changes; ensure consistent scoring and clear treatment decisions; drive risk treatment plans with accountable owners; escalate when timelines or residual risk are not acceptable; improve risk reporting for leadership: themes, systemic issues, KRIs/KPIs, and clear prioritization based on business criticality.