Director, Technology Risk

Overview

In this role, you lead the Second Line of defense for technology and info security risk across Mastercard’s digital asset initiatives. You’ll build and embed a robust Technology Control Framework, align with global standards, and oversee digital-asset infrastructure risks including custody models and blockchain integrations. You will challenge First Line assessments, drive remediation, and provide independent risk oversight in a fast-moving integration environment. This position offers impact at scale within a leading fintech player shaping secure, innovative digital payments.

Responsibilities

• Lead the Second Line implementation of a Technology Control Framework aligned to Mastercard standards using industry frameworks.
• Coordinate CCM approaches with traditional control testing and assurance.
• Define risk taxonomy, assessment methodology, and governance for digital-asset technology and security risk.
• Establish and maintain a 1LoD Control Library aligned to the Framework.
• Consolidate risk assessments, risk appetite, risk registers, and governance reporting into a single oversight view.
• Provide Second Line oversight of digital-asset infrastructure, including custody architecture, wallet design, blockchain integrations, and third-party dependencies.
• Assess technology and security implications of new digital-asset products and networks prior to launch.
• Identify and escalate custody, smart-contract, and third-party concentration risks.
• Offer risk expertise on cryptographic risks and key management across supported blockchain networks.
• Challenge First Line risk assessments, control design, and remediation plans; perform sample-based control validation.
• Support risk acceptance processes and governance escalation for BVNK; track remediations to closure.
• Represent Technology Risk in governance forums and coordinate with Compliance and Audit to ensure consistent standards.

Key requirements

• experience in technology risk, cyber risk, or second line oversight within regulated financial services or fintech
• knowledge of cloud platforms (AWS/GCP)
• experience with continuous control monitoring tools
• ability to design and embed practical risk-based control frameworks
• ability to translate standards (UCF, CRI Profile, NIST CSF, ISO 27001, SOC, PCI DSS, RCSA, FAIR) into governance decisions
• working knowledge of blockchain infrastructure and digital-asset custody models
• understanding of cryptographic practices underpinning blockchain
• familiarity with Three Lines of Defense and risk appetite concepts
• ability to influence across teams while maintaining independence
• comfort with high-growth, evolving environments and ambiguity

• clear communicator
• independent challenger
• external stakeholder influence
• cloud security (AWS, GCP)
• continuous control monitoring
• risk framework design (NIST CSF, ISO 27001, PCI DSS, FAIR)

…