Security Operations & Risk Automation Engineer

About the role

BVNK, a stablecoin-powered financial stack for enterprises now part of Mastercard, is looking for an experienced Security Operations & Risk Automation Engineer to join its Information Security team. The role strengthens and scales the security function by using automation to find technical, procedural and workflow vulnerabilities, automate user access reviews and enforce compliance guardrails across decentralized environments. It also establishes and governs the bug bounty programme and leads the engineering of controls needed for regulations such as the EU AI Act, DORA, AML and MiCA.

Key responsibilities

• Design, build and deploy automated workflows that continuously identify, map and mitigate security risks across custom tools and separate business environments.
• Automate user access reviews across disconnected internal and external systems.
• Implement, manage and scale the bug bounty programme, validating crowdsourced findings and tracking them to remediation.
• Lead technical risk mapping and governance for the AI Act, DORA, MiCA, GDPR, AML and other regulations, integrating Vanta with other tools.
• Write and maintain information security and operational risk policies, with a focus on technical governance for AI and emerging threats.
• Optimise automated compliance platforms to run the risk register, monitor control effectiveness and gather audit evidence with minimal manual effort.
• Lead technical GRC initiatives autonomously, from scoping to execution, coordinating with the Information Security Architect and GRC expert.

Required profile

• Bachelor's degree in Information Security, Computer Science, IT Audit, Risk Management or equivalent practical experience.
• 2-4 years of experience in technical GRC, IT Audit, Operational Risk Management or an automation-focused security or compliance role.
• Experience managing controls aligned with AML, MiCA and DORA requirements.
• Strong analytical skills to spot vulnerabilities in customised environments and third-party integrations.
• Proven ability to write clear, executive-ready security policies.

Required skills

• Ability to turn regulatory mandates and manual reviews into automated triggers and detection mechanisms.
• Familiarity with AWS, Docker, microservices and APIs is a plus.
• Experience with bug bounty platforms (HackerOne, Bugcrowd) and GRC platforms such as Vanta is a plus.

What we offer

• Hybrid working with flexible hours.
• A fair and competitive salary, with packages based on experience and certifications; the listed range for Bulgaria is EUR 55,000-80,000.
• Flexible holidays and opportunities to travel to offices around the world.