Back to jobs
New

IT Audit Manager

Vienna, Austria

About Us

Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance.
 
Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution.
 
Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services.

 

We are seeking an experienced IT Audit Manager / Senior Manager to lead and execute risk-based technology audits across our EU operations, with a focus on ICT risk governance, cybersecurity, operational resilience, data protection, third-party risk management, and technology governance.
Based in the EU region, preferably Austria, the role will play a key part in shaping and delivering the EU technology audit programme and ensuring appropriate audit coverage of applicable regulatory requirements, including DORA and related RTS and delegated regulations, MiCA, GDPR, NIS2, relevant EBA guidelines, and other applicable EU and local ICT and digital finance requirements.
The successful candidate will work closely with Technology, Engineering, Cybersecurity, Risk, Compliance, and other cross-functional teams to assess the design and effectiveness of ICT controls and provide independent, practical, and risk-based assurance across a fast-moving digital asset environment.
The role reports to the EU Head of Audit, with a dotted reporting line to the Global Head of IT Audit. The ideal candidate will combine strong IT audit and ICT risk expertise with a sound understanding of the EU regulatory landscape and the ability to independently lead complex, cross-border technology audits within a global organisation.

  1. Responsibilities

  1. EU Technology Audit Delivery

    • Lead and execute risk-based IT audits across EU operations, covering key technology, cybersecurity, ICT risk, operational resilience, data protection, and third-party risk areas.
    • Assess the design and effectiveness of ICT governance and controls against applicable EU regulatory requirements, including DORA and related RTS/delegated regulations, MiCA, MiFID II, EMI/payment services requirements, GDPR, NIS2, and relevant EBA guidelines.
    • Work closely with the Global IT Audit team on technology audits involving shared platforms, centralised infrastructure, and group-wide processes — adapting audit scope and testing to address EU-specific regulatory and licensing requirements while maintaining consistency with global methodology.

  1. Audit Planning & Risk Assessment

    • Contribute to the EU risk assessment and annual IT audit plan, considering regulatory priorities, emerging technology risks, business developments, and changes to the ICT environment.
    • Perform walkthroughs and risk assessments with Technology, Cybersecurity, Engineering, Risk, Compliance, and other stakeholders to understand key systems, processes, and control environments.
    • Monitor relevant EU regulatory and technology developments and assess their impact on the audit universe and planned coverage.

  1. Reporting & Remediation

    • Develop well-supported audit findings with clear risk articulation, relevant regulatory references, root-cause analysis, and practical remediation recommendations.
    • Prepare concise audit reports and management updates for senior management, the Audit Committee, and other governance forums.
    • Monitor remediation progress and independently validate the implementation and effectiveness of agreed corrective actions.

  1. Regulatory & Stakeholder Engagement

    • Support EU regulatory inspections, licensing and post-licensing reviews, and supervisory engagements, including those relating to Bybit EU's MiCA, EMI and MiFID-regulated activities, where relevant to technology and ICT risk.
    • Build effective relationships with Technology, Cybersecurity, Risk, Compliance, Legal, and business stakeholders across the EU and global organisation.
    • Communicate complex technology and regulatory matters clearly to both technical and non-technical stakeholders.
    • Collaborate with 2nd line functions (Compliance, Risk) on integrated assurance over ICT-related regulatory obligations, ensuring technology controls supporting regulatory compliance are appropriately assessed.

  1. Global Collaboration & Audit Development

  • Act as the EU focal point for the Global IT Audit team — jointly planning and executing technology audits on shared infrastructure, ensuring EU regulatory requirements are embedded in global audit scope, and contributing local expertise to group-wide technology assurance engagements.
  • Stay current on developments in digital assets, emerging technologies, cybersecurity risks, and the EU regulatory environment; share insights with global IT audit peers to strengthen cross-regional coverage.
  • Promote consistent audit methodologies, knowledge sharing, and a "One Team" approach across regions.

  1. Requirements

  1. Qualifications & Experience

    • Bachelor's degree in Information Systems, Computer Science, Engineering, Business, Risk Management, or a related discipline.
    • 8–12 years of experience in IT audit, technology risk, ICT risk, or technology assurance, preferably within financial services, fintech, payment services, or regulated digital asset environments.
    • Strong experience leading technology audits independently, from risk assessment and audit planning through fieldwork, reporting, and remediation validation.
    • Demonstrated experience working with cross-border teams and managing senior stakeholders across multiple functions and jurisdictions.
    • Experience within an EU-regulated financial institution, payment/e-money institution, investment firm, or crypto-asset service provider, or experience working directly with EU financial regulators, is highly advantageous.

  1. Regulatory & Technical Knowledge

    • Strong understanding of EU ICT and digital finance regulatory requirements, particularly:
      • DORA and associated RTS / delegated regulations;
      • MiCA;
      • MiFID II and relevant technology/control requirements applicable to investment services;
      • EMI and payment services regulatory requirements relevant to ICT governance and operational resilience;
      • GDPR and technology-related data protection requirements;
      • NIS2; and
      • relevant EBA ICT, security, and outsourcing guidelines.
    • Broad knowledge of ICT governance, cybersecurity, identity and access management, cloud environments, third-party risk management, operational resilience, incident management, SDLC, and change management.
    • Working knowledge of major cloud platforms such as AWS, sufficient to assess technology architecture, security controls, and governance arrangements.
    • Understanding of digital asset custody, wallet architecture, cryptographic key management, and blockchain technology is advantageous.
    • Proficiency in data analytics using SQL, Python, and AI-enabled tools to support audit planning, testing, continuous monitoring, and reporting. We build our own tooling — experience with bespoke analytics approaches is valued over off-the-shelf GRC platforms.

  1. Soft Skills

    • Strong analytical and critical-thinking skills, with the ability to translate complex ICT and regulatory matters into clear business risk.
    • Strong written and verbal communication skills, including the ability to produce concise, regulatory-quality audit reports.
    • Effective stakeholder management across cultures, functions, and time zones.
    • Self-directed and able to independently manage multiple audit engagements and priorities in a fast-moving environment.

  1. Certifications

    • CISA or CISM certification required. Additional certifications (CRISC, CISSP, or equivalent) are advantageous.
    • Additional qualifications or training relating to DORA, cybersecurity, operational resilience, or technology risk are advantageous.

  1. Other Requirements

    • High integrity, professional skepticism, sound judgement, and attention to detail.
    • Proficiency in English required; German language capability is highly desirable; Chinese language skills are a plus.
    • Location: EU-based, preferably Austria.
    • Willingness to travel within Europe and internationally where required for audit engagements.

Why Join Us
At Bybit, we are committed to fostering a supportive and enriching work environment. 
Our benefits include:
- Study Growth Fund: We support your professional development and continuous learning.
- Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation.
- Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world.
- Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company.
- Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.

Apply for this job

*

indicates a required field

Resume/CV*

Accepted file types: pdf, doc, docx, txt, rtf

Cover Letter

Accepted file types: pdf, doc, docx, txt, rtf

Select...

Please read the EU Data Privacy Policy as in the link below. Your answer will not affect your application or our recruitment decision.

I agree that the relevant Bybit entity acting as a data controller, as identified after submission of my application or otherwise during the recruitment process, may retain my candidate personal data for up to 2 years after my application is closed or rejected, so that Bybit may contact me about future roles that may be suitable for me.

I understand that I may withdraw this consent at any time by contacting the Data Protection Office of the relevant controller identified after submission of my application or otherwise during the recruitment process. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

To understand how we collect, use and protect your personal 
data, please read our EU Candidate Privacy Notice before 
responding: EU Candidate Data Privacy Policy

Select...
Select...
Select...
Select...
Select...