Security Operations & Risk Automation Engineer

BVNK is the stablecoin-powered financial stack for enterprises, now part of Mastercard. The Security Operations & Risk Automation Engineer joins the Information Security team to fortify, enhance, and scale the information security function by leveraging automation technologies to reduce systemic risk, automate user access reviews, enforce compliance guardrails, and establish and govern the bug bounty programme while leading the engineering of automated controls for regulatory frameworks such as the EU AI Act, DORA, AML, and MiCA. The role works closely with the Information Security Architect and the Information Security GRC expert.

Responsibilities

Design, build, and deploy automated workflows to continuously identify, discover, map, and mitigate security risks across separate business environments and bespoke tools; Programmatically orchestrate and streamline complex user access reviews across disconnected internal and external systems; Implement, manage, and scale the company's external bug bounty programme and act as the primary internal interface to validate crowdsourced findings and track them through to remediation; Lead the technical risk mapping and operational governance for regulations such as DORA, MiCA, AI Act, GDPR, and AML, integrating Vanta with other tools and processes; Formulate, publish, and maintain information security and operational risk policies, including technical governance for AI and emerging threats; Administer and optimise automated compliance platforms to manage the internal risk register, monitor control effectiveness, and drive automated audit evidence gathering; Autonomously lead technical GRC initiatives from scoping through execution, managing timelines, resource dependencies, and cross-functional coordination

Requirements

Bachelor's degree in Information Security, Computer Science, IT Audit, Risk Management, or equivalent practical experience; 2–4 years of experience in technical GRC, IT Audit, Operational Risk Management, or an automation-focused information security or compliance role; Prior exposure to managing or triage coordination for a bug bounty platform (e.g., HackerOne, Bugcrowd) or working closely with external application security researchers is a strong plus; Practical familiarity operating automated compliance software like Vanta or equivalent GRC platforms is a plus; Exceptional analytical capabilities to isolate operational vulnerabilities within heavily customised environments, third-party software integrations, and decentralized access registers; Direct experience managing controls aligned with financial and cybersecurity frameworks, specifically including AML rules, MiCA guidelines, and DORA requirements; Skill in translating text-heavy regulatory mandates and manual review processes into programmatic triggers and automated detection mechanisms, implementing AI and other technical tools at scale; Strong conceptual understanding of modern infrastructure components such as Amazon AWS, containers (Docker), microservices architecture, and API ecosystems; Proven ability to author clear, executive-ready information security policies that bridge engineering workflows with financial-grade compliance obligations

Nice to have

Prior exposure to managing or triage coordination for a bug bounty platform (e.g., HackerOne, Bugcrowd); Practical familiarity with Vanta or equivalent GRC platforms; Direct experience with AML rules, MiCA guidelines, and DORA requirements; Strong understanding of AWS, Docker, microservices architecture, and API ecosystems

Benefits

Fair and competitive salary at every stage of growth; Flexible working hours, with hybrid working at its heart; A flexible approach to holiday; Opportunities to travel to offices around the world; An open and creative environment