Description
Mastercard is seeking a Director, Services Technology Risk to lead the identification, assessment, prioritization, monitoring, and escalation of technology and operational risks across Services.
The ideal candidate is analytical, collaborative, and proactive, with a passion for identifying and managing risks, strengthening controls, and partnering with Engineering, Product, Security, and Business teams.
Responsibilities:
- Lead the Risk Identification and Assessment for Services, establishing the strategy, operating model, governance, and capabilities required to consistently identify, assess, prioritize, monitor, and manage technology and operational risk.
- Establish and mature standardized risk management practices across Services, including risk registers, product risk assessments, Risk and Control Self-Assessments (RCSAs), and risk acceptance and escalation.
- Modernize and scale risk identification and assessment through automation, analytics, and AI-enabled capabilities that improve the quality, timeliness, and efficiency of risk management.
- Maintain a consolidated view of material risks across Services products, platforms, and programs, ensuring clear ownership, accountability, and visibility into risk exposure, treatment, and status.
- Partner with Product and Engineering leaders to embed risk identification and assessment into business and technology processes, reinforcing their accountability for managing risks throughout the risk lifecycle.
- Provide effective risk challenge and judgment on material and emerging risks, including cybersecurity, resilience, regulatory, operational, and risks introduced by emerging technologies such as AI/ML and generative AI.
- Establish governance for residual risk acceptance and escalation, ensuring decisions are transparent, appropriately approved, aligned with established risk appetite and tolerance, and supported by clear ownership and rationale.
- Translate complex technology risks into clear business impact, tradeoffs, and actionable insights to support leadership decision-making, prioritization, investment, and remediation.
- Provide Services leadership with an integrated view of the risk profile, including material exposures, emerging risks, accepted risks, trends, and areas requiring management attention.
- Partner across Engineering, Product, Security, Business, and enterprise risk functions to drive consistent risk practices, reduce fragmentation and duplication, and strengthen overall risk management across Services.
- Lead and develop a team of technology risk professionals, fostering strong risk judgment, constructive challenge, accountability, and trusted partnerships across the organization.
Requirements:
- Significant experience in technology risk management, operational risk, information security risk, technology audit, technology controls, or a related discipline.
- Strong experience leading and maturing technology risk management practices across complex products, platforms, and business environments.
- Comfortable navigating ambiguity, resolving competing priorities, and establishing structure where processes are not yet mature.
- Strong interest in automation, analytics, and AI-enabled approaches to modernizing risk management.
- Strong understanding of technology risks across areas such as cybersecurity, data protection, software development, cloud services, identity and access management, vulnerability management, change management, third-party risk, and operational resilience.
- Ability to understand complex technology architectures and translate technical risks into clear business impact and decision points.
- Familiarity with regulatory expectations and data-residency requirements as they apply to technology controls, and with frameworks such as NIST, ISO 27001, and COBIT.
- Strong business judgment, with the ability to assess risk, challenge assumptions, evaluate tradeoffs, and provide practical recommendations.
- Demonstrated ability to influence senior Product, Engineering, Business, Security, and risk stakeholders.
- Ability to build practical and scalable operating models in complex or evolving environments.
- Proven experience leading, coaching, and developing high-performing teams.
- Strong written and verbal communication skills, including the ability to communicate complex risk matters clearly to technical and non-technical audiences.
- Bachelor’s degree required.
- Professional certifications such as CISA, CISSP, CRISC, CISM, or equivalent are preferred but not required.
Benefits:
- Insurance (including medical, prescription drug, dental, vision, disability, life insurance)
- Flexible spending account and health savings account
- Paid leaves (including 16 weeks of new parent leave and up to 20 days of bereavement leave)
- 80 hours of Paid Sick and Safe Time
- 25 days of vacation time and 5 personal days, pro-rated based on date of hire
- 10 annual paid U.S. observed holidays
- 401k with a best-in-class company match
- Deferred compensation for eligible roles
- Fitness reimbursement or on-site fitness facilities
- Eligibility for tuition reimbursement