Strategic Vendor Risk Manager – Fintech Payments

Tabby | تابي; Riyadh; On-site; SAR 180,000 - 300,000; Full time

Job summary

Tabby is seeking a Vendor Risk Manager in Riyadh to own the third-party risk program end to end, from due diligence to offboarding. You will rate vendor risk, collaborate with Legal and Procurement, and ensure controls, data localization, and SLAs with penalties are in place.

You will monitor critical vendors like KYC, payment processing, and banking partners, while translating risk findings for executives and driving effective mitigation across the business.

Qualifications

• 3-4 years in third-party risk management, vendor risk, or operational risk.
• Familiarity with NIST CSF, ISO 27001, SOC 2, SIG/CAIQ.
• Understanding regulatory data privacy (GDPR/CCPA) and PCI-DSS for vendor data.

Responsibilities

• Conduct due diligence on new vendors, including financial health, SOC 2/ISO 27001 reviews, breach history, and subprocessor mapping.
• Assign risk ratings with conditions for prospective vendors across KYC, identity verification, fraud detection, and payment/B2B vendors.
• Collaborate with Legal and Procurement to secure audit rights, breach windows, data localization, and SLAs with penalties.
• Own vendor risk assessments across the active portfolio and lead quarterly to annual reviews.
• Prepare vendor risk reporting for Risk Committee and Board with clear, actionable insights.

Skills

Vendor risk

NIST CSF

ISO 27001

SOC 2

SIG/CAIQ

PCI-DSS

Regulatory knowledge

Data privacy

English proficiency

Tools

OneTrust

ProcessUnity

Archer

Job description

Tabby is seeking a Vendor Risk Manager in Riyadh to own the third-party risk program end to end, from due diligence to offboarding. You will rate vendor risk, collaborate with Legal and Procurement, and ensure controls, data localization, and SLAs with penalties are in place.

You will monitor critical vendors like KYC, payment processing, and banking partners, while translating risk findings for executives and driving effective mitigation across the business.