Vendor Delivery Manager

Deblock; Porto; On-site; EUR 55,000 - 75,000; Full time

Benefits offered by this job

Competitive salary and stock options

The best tech for your job

30 days of paid holidays

Hybrid/remote work setting

Work abroad for 4 months a year

Job summary

Deblock in Porto is expanding its risk and compliance function to strengthen third-party and ICT risk under DORA for a regulated EMI and crypto-asset service provider. You will translate regulatory requirements into practical controls and governance that scale with the business.

You will build and monitor KRIs, run due diligence, manage the outsourcing register, and support the DORA programme, with a hybrid work model, 30 days holidays and a stock options sign-on bonus.

Qualifications

• Experience in third-party and ICT risk management.
• Ability to translate regulatory requirements into practical controls.
• Experience with regulatory frameworks (DORA is a plus).

Responsibilities

• Strengthen third-party and ICT risk framework, and governance standards.
• Run due diligence on providers across operational, ICT, compliance and financial risk.
• Own the register of outsourcing and ICT third-party arrangements, and the information it carries.
• Monitor provider performance, incidents and concentration risk; escalate what matters.
• Build KRIs, dashboards and reporting for management and board insight into exposure.
• Map critical/important functions and dependencies, including exit strategies and substitutability.
• Support DORA implementation across contracts, information registers, and resilience testing obligations.

Skills

Risk management

Regulatory compliance

Due diligence

Governance & controls

Job description

Deblock is building out its operational resilience capability, and third-party and ICT risk sits at the centre of it.
In this role you'll strengthen and scale the framework that governs how we select, assess and monitor the providers our services depend on, under DORA, and the wider regulatory expectations that apply to a regulated EMI and crypto-asset service provider.

You'll work across Compliance, Risk, Technology and Operations, turning regulatory requirements into controls that people actually run day to day. The work rewards someone who can hold a supervisor's perspective and a pragmatic one at the same time: the framework has to stand up to scrutiny and survive contact with a company that is still growing fast.

We want to revolutionise the FinTech industry. Create a new paradigm. And we need the best minds to do it

What You'll Be Working On

• Strengthening our third-party and ICT risk framework, and the policies, procedures and governance standards that sit underneath it
• Running due diligence on providers across operational, ICT, compliance and financial risk, and challenging assessments where the evidence doesn't hold
• Owning the register of outsourcing and ICT third-party arrangements, and the regulatory information it has to carry
• Monitoring provider performance, incidents and concentration risk on an ongoing basis, and escalating what matters
• Building the KRIs, dashboards and reporting that give management and the board a real view of third-party exposure
• Mapping critical or important functions and the dependencies behind them, including exit strategies and substitutability
• Supporting DORA implementation across contractual requirements, the register of information, and incident and resilience testing obligations

Assuming you want this section pushed further from the original shape — here it is restructured under themes, which changes how it reads on the page more than any amount of reworded bullets.

What You'll Be Working On

Understanding what we depend on

• Mapping our critical and important functions and the provider dependencies sitting behind them, including substitutability and exit planning
• Keeping the register of outsourcing and ICT third-party arrangements complete, current and carrying the information regulators expect to find in it

Deciding who we work with

• Assessing providers across operational, ICT, compliance and financial risk before we commit — and pushing back when the evidence doesn't support the conclusion
• Making sure contractual arrangements carry the provisions DORA requires, and that new arrangements clear governance before they go live

Watching what happens next

• Tracking provider performance, incidents and concentration risk once arrangements are running, and escalating what genuinely needs a decision
• Turning that into KRIs and reporting that give management and the board a real picture of third-party exposure rather than a compliance artefact

Making it hold

Evolving the policies, procedures and governance standards that keep all of the above repeatable as we grow

Supporting the wider DORA programme, including the register of information and incident and resilience testing obligations

• Competitive salary and a stock options sign-on bonus
• The best tech for your job
• 30 days of paid holidays
• Possibility to work from home in a hybrid setting
• Ability to work abroad for 4 months a year