Secure and Scale a Regulated Fintech Platform at the Heart of Stripe

Bridge Building S.A. (BBSA) is the Luxembourg regulated entity of Bridge, a Stripe company. We operate as an EMI and future CASP in one of Europe’s most demanding regulatory environments (CSSF, DORA, MiCA).

BBSA is building a local regulated platform powered by a global-first technology model. In this context, we are looking for a sharp IT GRC Analyst to act as the bridge between strict European regulations and high-velocity global engineering.

This role is the control and risk right hand of the Luxembourg Head of IT. While our global teams build the tech, you ensure it is compliant, resilient, and audit-ready. You will translate requirements like DORA and MiCA into tangible IT controls, oversee third-party risks, and maintain the integrity of our governance framework.

This is not a "tick-the-box" compliance role. It is a operational position for a professional who understands technology well enough to govern it effectively. You will have high visibility, owning the frameworks that allow us to scale securely.

Key Responsibilities

1. IT Governance & Risk Management

• • Maintain and evolve the IT Risk Register, ensuring risks are identified, assessed, and treated in line with the company’s risk appetite.
  • Drive the local implementation of the DORA (Digital Operational Resilience Act) framework, including ICT risk management and incident classification.
  • Bridge the gap between technical reality and policy by drafting, reviewing, and updating IT policies and procedures.
  • Perform periodic control testing to ensure global engineering practices align with local regulatory requirements.
  • Act as primary support to the local Head of IT 

1. Third-Party Risk Management (TPRM)

• • Support ICT due diligence and risk assessments of critical vendors and service providers, while assisting with  Developer / Customer Oversight.
  • Monitor SLAs and KPIs of critical vendors, challenging performance where necessary.
  • Act as the primary support to the Outsourcing Manager regarding technical vendor oversight.

1. Access Governance & Control (IAG)

• • Oversee the Identity & Access Governance strategy, including but not limited to adherence to Segregation of Duties, principle of least privileges and others..
  • Conduct periodic User Access Reviews for critical systems.

1. Regulatory Compliance & Audit Readiness

• • Act as the primary liaison for Internal Audit regarding IT topics.
  • Prepare technical inputs and evidence for CSSF notifications and regulatory reporting.
  • Monitor compliance with GDPR/Data Privacy controls (e.g., DLP oversight, data residency).
  • Coordinate Business Continuity (BCP) and Disaster Recovery (DR) testing documentation and reporting.

1. Incident Governance

• • Oversee the IT incident management process to ensure proper classification, reporting, and root cause analysis (RCA).
  • Ensure major incidents are reported to regulators within mandated timeframes (in collaboration with Compliance).

Candidate Profile

Education

• Bachelor’s or Master’s degree in Information Systems, Cybersecurity, or Business Administration (with a strong IT focus).

Experience

• 3–6 years of experience in IT Audit, IT Risk, GRC, or Information Security.
• Experience in a regulated sector (Banking, Fintech, Insurance) or Big 4 Audit (IT Risk advisory) is highly preferred.
• Experience dealing with CSSF circulars, EBA guidelines, or DORA is a strong asset.

Core Competencies

• Framework Knowledge: Strong understanding of ISO 27001, NIST, or COBIT.
• Tech Literacy: You don't need to code, but you must understand Cloud fundamentals (AWS), SaaS models, and modern infrastructure to audit them effectively.
• Risk Mindset: Ability to distinguish between theoretical risk and actual business risk.
• Communication: Ability to explain "Why we need this control" to engineers without slowing them down.

Languages

• English: Fluent professional (Mandatory).
• French: Asset.

Mindset

• Pragmatic: You value effective controls over bureaucratic paperwork.
• Resilient: You are comfortable dealing with ambiguity and evolving regulations.
• Curious: You have a genuine interest in crypto-assets, blockchain, and the future of payments.

We’re looking for a Junior Software Developer who can design, build, test, and ship high quality software that delivers value to our customers. You’ll work on a small and agile team that continuously incorporates feedback to refine and improve the products and features you deliver. You will learn and follow established patterns and best practices and be supported in delivering high quality work as part of the team. The team will own the entire delivery lifecycle from beta releases to production ready, scalable products suitable for new and existing customers. This job is open to candidates in Luxembourg, Luxembourg and will be reporting to Director, Software Development.

WHAT YOU’LL DO:

• Deliver low-complexity projects ensuring alignment with coding and design standards, testing practices, and company guidelines for security, accessibility, and privacy.
• Contribute to the successful execution of the team's roadmap by asking questions, providing input, and promptly escalating identified risks and scope changes.
• Actively engage in team activities, working out loud, learning from peers, contributing to code reviews and documentation as you work towards achieving team goals.
• Actively engage in troubleshooting, addressing minor bugs independently, and collaborating with senior team members to resolve more complex issues.
• Work within a cross-functional team, fostering positive team relationships, and maintain effective communication with peers and stakeholders.

WHAT YOU’LL NEED:

• A degree in Computer Science or Engineering, and some experience developing and maintaining software (including co-op terms and internships) or an equivalent level of education or work experience.
• Learn and follow existing patterns and best practices in delivering code and writing tests for individual stories.
• Experience with backend development in Java, or strong interest in learning them.
• Exposure to event-driven / streaming systems such as Kafka, including producing/consuming events and basic troubleshooting.
• Familiarity with cloud-native deployment: Docker, Kubernetes, and AWS (EC2, SQS) in a microservices environment.
• Basic understanding of monitoring & reliability using tools like Prometheus, Grafana, Sumologic.
• Ability to learn about and use root cause analysis to identify and address bugs and outages. Follow logging, monitoring and debugging best practices in the components and classes you work on.
• Learn and follow existing architecture concepts and best practices to extend existing software modules and components that meet system performance, modifiability, maintainability and reliability needs.
• Learn about and follow basic security and compliance practices in daily work.
• Follow common agile processes and continuous integration and delivery practices to ship stories and own low complexity epics/projects.
• You can collaborate and communicate effectively within a team. Participate in technical discussions, listen actively and understand non-technical input from design and product.
• Actively seek guidance, feedback, and learning opportunities within the team to foster personal and professional growth.
• Display eagerness to learn and collaborate on goal-setting. Supported in creating and aligning goals with personal development.
• Understand roadmaps and participate in delivering on them effectively by communicating risks and opportunities at the individual level.
• Customer Focus: demonstrates a desire to proactively help and serve internal/external customers meet their needs
• Perseverance: pursues everything with energy, drive, and a need to finish—doesn’t give up
• Resilience, Tolerance for Change/Ambiguity: can effectively cope with change, finding ways to advance work and projects

WHO YOU ARE:

• Solution seeker. You’re focused on tackling new challenges, solving problems, and moving the business forward—and you don’t wait to be asked.
• Lifelong learner. You have a growth mindset – you’re here to learn, experiment, seek, apply, and provide feedback, share what works with your team, and move on from what doesn’t.
• Resilient adapter. In the face of change and challenges, you bring a thoughtful, calm approach, and a focus on finding the new opportunity.
• Intentional collaborator. You build positive working relationships across the business, bringing people together to foster new opportunities and to facilitate the efficient flow of information.
• Critical challenger. You have the trust in your team to ask difficult questions in order to get to the best end result.
• Active communicator. You listen actively and communicate ideas and information clearly, inclusively, and proactively.
• Integrated thinker. You look beyond your role and responsibilities to understand how your team’s work drives broader organizational goals.
• Accountable owner. You take pride in the work you’re responsible for with a mindset of ultimate accountability and reliability for the outcomes.
• Bar-raiser. You step up to help your team grow and succeed, even when that means going beyond what might be expected.

In all we do, our six guiding principles light the way:

Step Up: Dare to go beyond the expected to achieve greatness. #StepUp

One Team: Make Hootsuite a place we soar together by respecting each other's individuality, building trust, and showing up for the team. #OneTeam #FreeToBeMe

Customer Obsessed: Focus relentlessly on helping our customers succeed. #CustomerObsessed

Go Fast, Be Agile: Widen our competitive advantage by committing to speed and simplicity over perfection and complexity. #GoFastBeAgile

Play to Win: Commit to building an incredible, profitable company for our customers, our employees, and our stakeholders. #PlayToWin #NoExcuses

Neighbours & Allies: Give back to our communities and be an ally. #SocialForGood #Allies

Accommodations will be provided as requested by candidates taking part in all aspects of the selection process.

#LI-IA #LI-Remote

About us

We’re Littlepay - a growing fintech headquartered in Melbourne with operations in the UK, EU, LATAM, USA, and Australia. Our payments platform enables our customers to pay for public transport using any payment card, mobile wallet, or wearable device. Processing over USD 1 billion a year in 19 countries and continuing to expand globally, we’re proud to move more people through better payment experiences.

About the opportunity

The Littlepay Platform Team provides tooling and support for our Engineering organisation, owns shared and fundamental services, and collaborates with teams for their DevOps or infrastructure projects. Joining the Infra side of the team, you’ll be working closely with your Infra team mates and with the Platform Devex team on build systems, production support, and PCI-compliant infrastructure. You’ll encourage and support DevOps practises through tooling, vendor management and support. You’ll also work on and be on call for our base infrastructure across the platform, including networking, ECS runtime, PKI and RDS.

Key Responsibilities

This role calls for a self-sufficient engineer who can use their experience to:

• Support devops practises by maintaining tooling infrastructure and providing day-to-day troubleshooting
• Join the on-call roster for our platform across weekdays, overnights and weekends
• Consider and improve the Littlepay software ecosystem across the full build-test-deploy- release-monitor cycle
• Maintain, improve and design cost-effective and scalable PCI-compliant infrastructure
• Mentor and support platform team members
• Stay up-to-date with AWS services and industry trends
• Write and maintain internal tools, services and documentation
• Support the Littlepay engineering function

About You:

Core Skills and Attributes

• Programming and Scripting — any language, familiarity with Java, Go and Bash preferred
• Communication — we do a lot of communicating and strong written and verbal will be important
• Empathy — we’re a service provider, so having high empathy for our internal stakeholders is a big deal
• A love of learning — we take learning and growth seriously and you’ll need to be down with that

For this role we are specifically looking for candidates who are strong in:

• AWS — especially serverless runtime and cloud networking
• DevOps — releasing software is your jam, you know what a DORA metric is and how to use it to improve processes, experience with Buildkite preferred
• DevSecOps — security is at the heart of everything we do, so must be considered a fundamental part of the DevOps cycle

Our Benefits

We love to look after our people. At Littlepay, you'll be part of an inclusive and diverse team that celebrates the differences and unique gifts we each bring to work.

You’ll have access to:

• A high trust working environment, with access to cloud collaboration tools like Notion, Slack, Miro, Google Workspace, and Jira to help us work together effectively
• Paid professional development (including conferences, courses, learning subscriptions, etc.)
• Harrison Assessments - our talent management provider that facilitates continuous professional development
• A variety of flexible leave options
• A company-wide paid day off
• Our generous employee referral program
• Wellbeing support- including a free School of Life subscription for all employees
• Mid-year, quarterly, and end-of-year corporate and team events and workshops
• Short-term remote working arrangements
• International travel opportunities (dependent on role)

In-office expectations

At Littlepay, we believe great work happens when we solve problems, together. We see in-person collaboration as an important way to build connections, share ideas, and support each other meaningfully.

For those assigned to an office location, we generally expect a minimum two-day presence in the office each week. This may vary depending on your role, team, and location. For example, our team in Luxembourg works 4 days from the office, whereas our AU and UK teams currently work a minimum of 2 days onsite in our Melbourne/London offices. Some positions might require more frequent office attendance to support cross-functional collaboration, customer engagement, or specific team workflows. Your hiring manager will provide details relevant to your role.

We aim to strike a healthy balance between in-person connection and flexibility, while staying connected to deliver with speed and agility as we continue to scale, ensuring our ways of working support both our people and our shared ambition to move more people through better payment experiences.

Our Recruitment Process

If you’ve been shortlisted for the role, you’ll first have a chat with our Talent team, who will set up an interview if the stars align. A short workplace preferences questionnaire will also be sent to help us learn more about the way you prefer to work. Following a successful first interview, you’ll meet with a second set of Littlepay folks, and be invited to participate in the final stage before being presented with an offer.

If you have any questions regarding the recruitment process or if you require any accommodations for any stage in the interview process, please don’t hesitate to let us know. Additionally, if you don’t meet all of the criteria (we know that some underrepresented groups tend to avoid applying if they don’t), please still apply. We really enjoy meeting people who might bring a fresh perspective on a problem we need to solve!

Ultimately, being part of our small but mighty team means you'll have the opportunity to learn about micropayments, and have a hand in the provision of services that impact millions of people. You’ll help us deliver on our revolutionary product roadmap and help scale our platform as we continue to expand across the globe.

If this opportunity interests you, hit apply! We look forward to learning about you.