Security Operations & Risk Automation Engineer

Job description

**About us:** BVNK is the stablecoin-powered financial stack for enterprises. We're now part of Mastercard, and together we're building a network for every form of money – one that delivers more reach, more capability and more choice. We enable businesses to build financial products, unlock new markets, and move money in seconds across 130+ countries, with 40+ licenses for fiat and digital assets globally. Processing billions annually, we empower enterprises worldwide to send, receive, convert, and settle stablecoins and fiat seamlessly through a single integration. Our mission is to accelerate global money movement, and we're assembling a world-class team to make it happen. Trusted by industry leaders like Corpay, Worldpay, Deel, and Flywire, we deliver the infrastructure that makes new forms of money usable within the financial systems customers already rely on today. By combining Mastercard's global payment reach and trusted networks with BVNK's stablecoin infrastructure, we're building the trusted operating layer for the evolution of money movement, helping customers participate in emerging digital networks without having to rebuild their businesses around every new innovation. We're a diverse team spread across EMEA, North America, and APAC, with a shared belief that stablecoins are the new infrastructure layer for financial services, and that BVNK is at the forefront of this shift. **We're incredibly honored to have been recognized by:** - CNBC World's Top Fintech Companies (2026) - FXC Intelligence Top 100 Cross-border Payment Companies (2026) - Newsweek's The Top 100 Global Most Loved Workplaces (three years running, most recently 2025) - LinkedIn as one of the Top 20 Startups in the UK (2025) **Location**: We offer a Hybrid/Remote working policy. **FUNCTION**: Engineering We are seeking an experienced **Security Operations & Risk Automation Engineer** to join our Information Security team. The Security Operations & Risk Automation Engineer at BVNK plays a pivotal role in fortifying, enhancing, and scaling our information security function. This role focuses on leveraging cutting-edge automation technologies to reduce systemic risk by continuously discovering technical, procedural, and workflow vulnerabilities, automating user access reviews, and enforcing compliance guardrails across disparate, decentralized environments. The ideal candidate is a technical security or risk professional who designs automated processes to monitor custom tools and decentralized systems, significantly lowering the company risk footprint. Additionally, this position will establish and govern BVNK’s bug bounty programme, translating external vulnerability findings into internal security policy improvements while leading the engineering of the automated controls required to satisfy regulatory frameworks such as the EU AI Act, DORA, AML, MiCA, and others. The Security Operations & Risk Automation Engineer will work closely with the Information Security Architect and the Information Security GRC (Governance, Risk and Compliance) expert to define and implement risk mitigations based on assessments, audits, and regulatory frameworks. **Key Areas of Responsibilities:** - **Systematic Risk Reduction:** Design, build, and deploy automated workflows to continuously identify, discover, map, and mitigate security risks across separate business environments and bespoke tools. - **Cross-System Access Automation:** Programmatically orchestrate and streamline complex user access reviews across disconnected internal and external systems that may utilise independent user management interfaces. - **Bug Bounty Programme Management:** Implement, manage, and scale the company's external bug bounty programme. Act as the primary internal interface to validate crowdsourced findings and track them through to successful remediation. - **Regulatory Control Engineering (AI Act, DORA, MiCA, etc.):** Lead the technical risk mapping and operational governance for the applicable regulations. Maintain consistent control alignment with the Digital Operational Resilience Act (DORA), MiCA, AI Act, GDPR, AML regulations, and global operational resilience principles by integrating Vanta with other tools and processes. - **Policy & Control Governance:** Formulate, publish, and maintain information security and operational risk policies that reflect corporate security objectives while integrating newly identified risk vectors, focusing on technical governance for AI and newly emerging threats. - **GRC Platform Optimisation:** Administer and optimise automated compliance platforms to manage the internal risk register, monitor control effectiveness, and drive hands-free audit evidence gathering by integrating and extending the capabilities of AI and other technical tools. - **Project Management:** Autonomously lead technical GRC initiatives from scoping through to execution, managing timelines, tracking resource dependencies, and coordinating across cross-functional infrastructure teams. **What we need from you:** - Bachelor's degree in Information Security, Computer Science, IT Audit, Risk Management, or equivalent practical experience. - 2–4 years of experience in technical GRC, IT Audit, Operational Risk Management, or an automation-focused information security or compliance role. - Vulnerability Program Exposure: Prior exposure to managing or triage coordination for a bug bounty platform (e.g., HackerOne, Bugcrowd) or working closely with external application security researchers is a strong plus. - Platform Experience: Practical familiarity operating automated compliance software like Vanta or equivalent GRC platforms is a plus. - Risk Identification & Mitigation: Exceptional analytical capabilities to isolate operational vulnerabilities within heavily customised environments, third-party software integrations, and decentralized access registers. - Regulated Fintech Exposure: Direct experience managing controls aligned with financial and cybersecurity frameworks, specifically including AML rules, MiCA guidelines, and DORA requirements. - Technical Scaffolding & Automation: Skill in translating text-heavy regulatory mandates and manual review processes into programmatic triggers and automated detection mechanisms, implementing AI and other technical tools at scale. - Architectural Literacy: Strong conceptual understanding of modern infrastructure components—such as Amazon AWS, containers (Docker), microservices architecture, and API ecosystems—enabling effective risk oversight in highly technical environments. - Policy Crafting: Proven ability to author clear, executive-ready information security policies that bridge engineering workflows with financial-grade compliance obligations. **What you can expect from us:** - Fair and **competitive salary** at every stage of your growth - **Flexible** working hours, with hybrid working at its heart - A **culture** built on passionate, growth-minded people - A **flexible** approach to holiday - Opportunities to travel to our **offices around the world** - An **open and creative environment** where you can help us define the future of BVNK, its culture, and its opportunity sets *At BVNK, we are focused on building a diverse and inclusive team. While you may not meet all of our requirements, we’d encourage you to apply if you meet the majority of our expectations. You may be a great fit for this role or another role in our team.* Compensation packages are based on candidate experience and relevant certifications. Bulgaria Salary Range €55.000—€80.000 EUR