Director, Technology Risk

Mastercard Inc.; Hayes End; On-site; GBP 120,000 - 180,000; Full time

Job summary

Mastercard is seeking a Director of Technology Risk to lead the Second Line oversight for digital asset risk, governance and controls across BVNK and Mastercard platforms. You will align frameworks such as NIST CSF, ISO 27001, PCI DSS and FAIR with digital-asset realities including custody, wallets and third-party integrations.

You will partner with First Line teams to challenge risk assessments, manage risk acceptance, and drive continuous control monitoring within a fast-moving integration

Qualifications

• Experience in technology risk, cyber risk and operational resilience in a large regulated environment.
• Ability to translate standards (UCF, NIST CSF, ISO 27001, PCI DSS, FAIR) into practical controls.
• Strong communication to senior stakeholders and independent challenge in a 2LoD context.

Responsibilities

• Lead the Second Line build-out of technology risk oversight for digital asset strategies and operations.
• Define and implement a Technology Control Framework aligned to Mastercard standards.
• Challenge First Line risk assessments, control design and remediation; drive governance reporting.

Skills

Technology risk

Cyber risk

Operational resilience

Second Line oversight

Tools

AWS

GCP

CCM tools

Job description

Our Purpose

Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.

Title and Summary Director, Technology Risk

Who is Mastercard? Mastercard is a global technology company in the payments sector. We power payments and provide products and services for individuals and industries all around the world. Our people, technology, data and brand provide the capabilities that drive our success. We believe in connecting people to priceless possibilities. As a company, we know that our success is driven by the skills, experience, integrity and mindset of the talent we hire. By building an inclusive, world-class culture, our employees have once-in-a-career opportunities to be a part of teams that have a greater impact on our community and our world. We invite you to join our team to find out how you too can start something priceless.

Overview

The Digital Asset Risk & Compliance team is looking for a Director, Technology Risk to lead the Second Line build-out of technology and information security (InfoSec) risk oversight for Mastercard’s digital asset strategy, products and operations. The role will align BVNK’s First- and Second-Line approach with Mastercard’s Technology Risk and InfoSec standards, leveraging industry frameworks such as UCF, the CRI Profile, NIST CSF, ISO 27001, CSA Cloud Controls Matrix (CCM), SOC, PCI DSS, FAIR and RCSA, while incorporating considerations unique to digital assets such as custody models, blockchain infrastructure, smart-contract dependencies and third-party integrations. The role requires the ability to operate in a fast-moving integration environment, distinguish material technology risks from execution noise, and provide specialist oversight of digital-asset infrastructure with independent challenge of First Line risk assessments, control design and remediation.

Role

• Technology & InfoSec Risk Framework (2LoD Build-Out)
• Lead the Second Line implementation and coordination of a Technology Control Framework aligned to Mastercard standards — leveraging UCF, the CRI Profile, NIST CSF, ISO 27001, SOC, PCI DSS, FAIR and RCSA — incorporating risks unique to digital asset environments, and aligned with BVNK’s First Line approach.
• Support integration of continuous control monitoring (CCM) approaches and tools with more traditional control testing and assurance.
• Define risk taxonomy, assessment methodology, control standards and governance routines specific to digital-asset technology and security risk.
• Drive establishment of a 1LoD Control Library that aligns to the coordinated Technology Control Framework.
• Connect technology risk assessments, control libraries, risk appetite, risk registers and governance reporting into a single, coherent oversight view, and align decision-making to Mastercard's Risk Appetite Framework, including risk objectives and measurable tolerances.
• Provide specialist Second Line oversight of digital-asset infrastructure, including custody architecture, wallet design (hot/cold/multi-sig), blockchain network integrations, node and validator operations, cloud hosting and third-party/vendor dependencies.
• Maintain a current view of technology architecture, dependencies and risk exposures across Mastercard’s and BVNK’s digital-asset platforms.
• Assess the technology and security implications of new digital-asset products, integrations and chain/network additions before launch.
• Identify and escalat e emerging technology and infrastructure risks, including custodial key compromise, smart-contract failure and third-party concentration risk.
• Provide Second Line oversight and subject-matter expertise on cryptographic risks across supported blockchain networks, including key management and the control environment protecting digital assets held in wallets and custody solutions.
• Challenge First Line technology and security teams on risk assessments, control design, risk ratings, risk acceptances, issues and remediation plans.
• Perform sample-based control validation on critical services and key business units — including cloud infrastructure environments, digital asset infrastructure such as wallets, custody and blockchain integrations — to assess control design and effectiveness, remaining independent from the broader QA/testing function.
• Support risk acceptance processes for BVNK, including review, challenge and escalation of material accepted risks to relevant governance forums.
• Track open issues, risk acceptances and remediation commitments to closure, escalating overdue or high-risk items through governance.
• Represent Technology Risk in relevant governance forums and contribute to effective risk-based decision-making across technology, security and product stakeholders.
• Partner with InfoSec, Technology Risk, Compliance and Audit to ensure consistent application of standards and avoid duplicative or conflicting oversight.

All About You:

• Experience in technology risk, cyber risk, operational resilience, control assurance or second line technology oversight within a large, regulated financial services, payments, fintech or technology environment.
• Experience and working knowledge of modern cloud (e.g. AWS / GCP) hosted infrastructure and networks and knowledge
• Experience with continuous control monitoring tools
• Demonstrated ability to design, implement and embed technology control frameworks that are practical, risk-based and aligned to business outcomes — not just compliance checklists.
• Ability to translate industry standards such as UCF, CRI Profile, NIST CSF, ISO 27001, SOC, PCI DSS, RCSA and FAIR into a coherent control framework that supports governance, assurance and risk appetite decisions.
• Working knowledge of blockchain infrastructure, digital-asset custody models, wallet architecture and related technology dependencies, or strong aptitude to build this quickly.
• Working knowledge of cryptographic practices that underpin blockchain and digital assets
• Strong understanding of Second Line oversight, independent challenge, risk appetite and the Three Lines of Defense model.
• Experience partnering with First Line technology, product, engineering, security and operations teams on risk assessments, control design, issue management and remediation — influencing without direct authority while maintaining independence.
• Ability to perform targeted, sample-based control validation while maintaining independence from broader QA/testing functions.
• Comfortable operating in high-growth, fast-moving integration environments where processes are evolving and documentation may be incomplete — building a function from the ground up and driving execution in ambiguity.
• Rigorous without being bureaucratic — applies control expectations proportionately to strengthen the business while avoiding unnecessary friction.
• Clear communicator who can translate complex technical risk into decision-ready material, risk implications and actions for senior stakeholders.

Corporate Security Responsibility

• Abide by Mastercard’s security policies and practices
• Ensure the confidentiality and integrity of the information being accessed
• Report any suspected information security violation or breach, and Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.

Everyone wants easier ways to pay; we invent them. Checkout lines are slow; we speed them along. Merchants want more sales; we give them data and insights. People need financial access; we connect them. Corporate purchasing is complicated; we make it simple. Commuters are busy; we speed them on their way. Governments need greater efficiencies; we help create them. Small businesses are virtual; we give them access to a world of buyers. Retailers want to fight fraud; we provide the tools.