Internal Auditor - Data Security & AI

Ready to Get Shit Done?

At bunq, we're building a bank that lives in the cloud, handles billions of transactions, and now integrates AI into our operations—all while keeping our user's data and trust intact. To operate at this scale and speed without compromising security, we need an Internal Auditor focused on Data Security & AI to audit our security controls, validate our AI governance, and ensure every system we build is resilient and trustworthy.

As an Internal Auditor – Data Security & AI, your mission is to strengthen bunq's security and AI governance posture by auditing data protection controls, assessing AI model risks, identifying vulnerabilities before attackers do, and ensuring our security practices evolve as fast as our technology.

Take Ownership

As an Internal Auditor - Data Security & AI, you'll own:

• Audit security controls across infrastructure, applications, and operations, assessing access controls, encryption, monitoring, incident response, and third-party security effectiveness.
• Build an AI governance audit program that evaluates model development, bias testing, monitoring, transparency, and regulatory alignment (AI Act, NIS2).
• Identify and prioritize security and AI risks, conducting vulnerability assessments, pen test reviews, and model audits to surface gaps before they're exploitable.

What You'll Work on Right Away

1. Security Control Assessment: Audit bunq's critical security infrastructure (cloud environment, API security, data encryption, access management) and validate the effectiveness of controls; deliver a risk-prioritized remediation roadmap.
2. AI Model Governance Program: Design and execute bunq's first AI audit program, evaluating model development practices, data quality controls, bias testing, monitoring, and transparency, identifying governance gaps and building a scalable AI audit framework.
3. Data Protection & Privacy Audit: Conduct a comprehensive audit of bunq's data handling practices across all systems, assessing compliance with GDPR, data minimization principles, and data retention policies.