Director, Technology Risk
Full-time
Mastercard
Our Purpose Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential. Title and Summary
The Digital Asset Risk & Compliance team is looking for a Director, Technology Risk to lead the Second Line build-out of technology and information security (InfoSec) risk oversight for Mastercard’s digital asset strategy, products and operations. The role will align BVNK’s First- and Second-Line approach with Mastercard’s Technology Risk and InfoSec standards, leveraging industry frameworks such as UCF, the CRI Profile, NIST CSF, ISO 27001, CSA Cloud Controls Matrix (CCM), SOC, PCI DSS, FAIR and RCSA, while incorporating considerations unique to digital assets such as custody models, blockchain infrastructure, smart-contract dependencies and third-party integrations. The role requires the ability to operate in a fast-moving integration environment, distinguish material technology risks from execution noise, and provide specialist oversight of digital-asset infrastructure with independent challenge of First Line risk assessments, control design and remediation. Role:
Technology & InfoSec Risk Framework (2LoD Build-Out)
• Lead the Second Line implementation and coordination of a Technology Control Framework aligned to Mastercard standards — leveraging UCF, the CRI Profile, NIST CSF, ISO 27001, SOC, PCI DSS, FAIR and RCSA — incorporating risks unique to digital asset environments, and aligned with BVNK’s First Line approach.
• Support integration of continuous control monitoring (CCM) approaches and tools with more traditional control testing and assurance.
• Define risk taxonomy, assessment methodology, control standards and governance routines specific to digital-asset technology and security risk.
• Drive establishment of a 1LoD Control Library that aligns to the coordinated Technology Control Framework.
• Connect technology risk assessments, control libraries, risk appetite, risk registers and governance reporting into a single, coherent oversight view, and align decision-making to Mastercard's Risk Appetite Framework, including risk objectives and measurable tolerances.
Digital-Asset Infrastructure Oversight
• Provide specialist Second Line oversight of digital-asset infrastructure, including custody architecture, wallet design (hot/cold/multi-sig), blockchain network integrations, node and validator operations, cloud hosting and third-party/vendor dependencies.
• Maintain a current view of technology architecture, dependencies and risk exposures across Mastercard’s and BVNK’s digital-asset platforms.
• Assess the technology and security implications of new digital-asset products, integrations and chain/network additions before launch.
• Identify and escalate emerging technology and infrastructure risks, including custodial key compromise, smart-contract failure and third-party concentration risk.
• Provide Second Line oversight and subject-matter expertise on cryptographic risks across supported blockchain networks, including key management and the control environment protecting digital assets held in wallets and custody solutions.
Independent Challenge, Control Validation & Remediation
• Challenge First Line technology and security teams on risk assessments, control design, risk ratings, risk acceptances, issues and remediation plans.
• Perform sample-based control validation on critical services and key business units — including cloud infrastructure environments, digital asset infrastructure such as wallets, custody and blockchain integrations — to assess control design and effectiveness, remaining independent from the broader QA/testing function.
• Support risk acceptance processes for BVNK, including review, challenge and escalation of material accepted risks to relevant governance forums.
• Track open issues, risk acceptances and remediation commitments to closure, escalating overdue or high-risk items through governance.
• Represent Technology Risk in relevant governance forums and contribute to effective risk-based decision-making across technology, security and product stakeholders.
• Partner with InfoSec, Technology Risk, Compliance and Audit to ensure consistent application of standards and avoid duplicative or conflicting oversight. All About You:
• Experience in technology risk, cyber risk, operational resilience, control assurance or second line technology oversight within a large, regulated financial services, payments, fintech or technology environment.
• Experience and working knowledge of modern cloud (e.g. AWS / GCP) hosted infrastructure and networks and knowledge
• Experience with continuous control monitoring tools
• Demonstrated ability to design, implement and embed technology control frameworks that are practical, risk-based and aligned to business outcomes — not just compliance checklists.
• Ability to translate industry standards such as UCF, CRI Profile, NIST CSF, ISO 27001, SOC, PCI DSS, RCSA and FAIR into a coherent control framework that supports governance, assurance and risk appetite decisions.
• Working knowledge of blockchain infrastructure, digital-asset custody models, wallet architecture and related technology dependencies, or strong aptitude to build this quickly.
• Working knowledge of cryptographic practices that underpin blockchain and digital assets
• Strong understanding of Second Line oversight, independent challenge, risk appetite and the Three Lines of Defense model.
• Experience partnering with First Line technology, product, engineering, security and operations teams on risk assessments, control design, issue management and remediation — influencing without direct authority while maintaining independence.
• Ability to perform targeted, sample-based control validation while maintaining independence from broader QA/testing functions.
• Comfortable operating in high-growth, fast-moving integration environments where processes are evolving and documentation may be incomplete — building a function from the ground up and driving execution in ambiguity.
• Rigorous without being bureaucratic — applies control expectations proportionately to strengthen the business while avoiding unnecessary friction.
• Clear communicator who can translate complex technical risk into decision-ready material, risk implications and actions for senior stakeholders. Corporate Security Responsibility
Director, Technology Risk
Who is Mastercard?
Mastercard is a global technology company in the payments sector. We power payments and provide products and services for individuals and industries all around the world. Our people, technology, data and brand provide the capabilities that drive our success. We believe in connecting people to priceless possibilities.
The Digital Asset Risk & Compliance team is looking for a Director, Technology Risk to lead the Second Line build-out of technology and information security (InfoSec) risk oversight for Mastercard’s digital asset strategy, products and operations. The role will align BVNK’s First- and Second-Line approach with Mastercard’s Technology Risk and InfoSec standards, leveraging industry frameworks such as UCF, the CRI Profile, NIST CSF, ISO 27001, CSA Cloud Controls Matrix (CCM), SOC, PCI DSS, FAIR and RCSA, while incorporating considerations unique to digital assets such as custody models, blockchain infrastructure, smart-contract dependencies and third-party integrations. The role requires the ability to operate in a fast-moving integration environment, distinguish material technology risks from execution noise, and provide specialist oversight of digital-asset infrastructure with independent challenge of First Line risk assessments, control design and remediation. Role:
Technology & InfoSec Risk Framework (2LoD Build-Out)
• Lead the Second Line implementation and coordination of a Technology Control Framework aligned to Mastercard standards — leveraging UCF, the CRI Profile, NIST CSF, ISO 27001, SOC, PCI DSS, FAIR and RCSA — incorporating risks unique to digital asset environments, and aligned with BVNK’s First Line approach.
• Support integration of continuous control monitoring (CCM) approaches and tools with more traditional control testing and assurance.
• Define risk taxonomy, assessment methodology, control standards and governance routines specific to digital-asset technology and security risk.
• Drive establishment of a 1LoD Control Library that aligns to the coordinated Technology Control Framework.
• Connect technology risk assessments, control libraries, risk appetite, risk registers and governance reporting into a single, coherent oversight view, and align decision-making to Mastercard's Risk Appetite Framework, including risk objectives and measurable tolerances.
Digital-Asset Infrastructure Oversight
• Provide specialist Second Line oversight of digital-asset infrastructure, including custody architecture, wallet design (hot/cold/multi-sig), blockchain network integrations, node and validator operations, cloud hosting and third-party/vendor dependencies.
• Maintain a current view of technology architecture, dependencies and risk exposures across Mastercard’s and BVNK’s digital-asset platforms.
• Assess the technology and security implications of new digital-asset products, integrations and chain/network additions before launch.
• Identify and escalate emerging technology and infrastructure risks, including custodial key compromise, smart-contract failure and third-party concentration risk.
• Provide Second Line oversight and subject-matter expertise on cryptographic risks across supported blockchain networks, including key management and the control environment protecting digital assets held in wallets and custody solutions.
Independent Challenge, Control Validation & Remediation
• Challenge First Line technology and security teams on risk assessments, control design, risk ratings, risk acceptances, issues and remediation plans.
• Perform sample-based control validation on critical services and key business units — including cloud infrastructure environments, digital asset infrastructure such as wallets, custody and blockchain integrations — to assess control design and effectiveness, remaining independent from the broader QA/testing function.
• Support risk acceptance processes for BVNK, including review, challenge and escalation of material accepted risks to relevant governance forums.
• Track open issues, risk acceptances and remediation commitments to closure, escalating overdue or high-risk items through governance.
• Represent Technology Risk in relevant governance forums and contribute to effective risk-based decision-making across technology, security and product stakeholders.
• Partner with InfoSec, Technology Risk, Compliance and Audit to ensure consistent application of standards and avoid duplicative or conflicting oversight. All About You:
• Experience in technology risk, cyber risk, operational resilience, control assurance or second line technology oversight within a large, regulated financial services, payments, fintech or technology environment.
• Experience and working knowledge of modern cloud (e.g. AWS / GCP) hosted infrastructure and networks and knowledge
• Experience with continuous control monitoring tools
• Demonstrated ability to design, implement and embed technology control frameworks that are practical, risk-based and aligned to business outcomes — not just compliance checklists.
• Ability to translate industry standards such as UCF, CRI Profile, NIST CSF, ISO 27001, SOC, PCI DSS, RCSA and FAIR into a coherent control framework that supports governance, assurance and risk appetite decisions.
• Working knowledge of blockchain infrastructure, digital-asset custody models, wallet architecture and related technology dependencies, or strong aptitude to build this quickly.
• Working knowledge of cryptographic practices that underpin blockchain and digital assets
• Strong understanding of Second Line oversight, independent challenge, risk appetite and the Three Lines of Defense model.
• Experience partnering with First Line technology, product, engineering, security and operations teams on risk assessments, control design, issue management and remediation — influencing without direct authority while maintaining independence.
• Ability to perform targeted, sample-based control validation while maintaining independence from broader QA/testing functions.
• Comfortable operating in high-growth, fast-moving integration environments where processes are evolving and documentation may be incomplete — building a function from the ground up and driving execution in ambiguity.
• Rigorous without being bureaucratic — applies control expectations proportionately to strengthen the business while avoiding unnecessary friction.
• Clear communicator who can translate complex technical risk into decision-ready material, risk implications and actions for senior stakeholders. Corporate Security Responsibility
All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:
- Abide by Mastercard’s security policies and practices;
- Ensure the confidentiality and integrity of the information being accessed;
- Report any suspected information security violation or breach, and
- Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.
Vacancy posted 1 day ago
Similar jobs that could be interesting for youBased on the Director, Technology Risk in United Kingdom vacancy
- ...Want to accelerate your career? Electrify your potential as a Track Technology Manager and join the fastest growing motorsport on the planet! About Formula E: Formula E, the world's fastest-growing sport, is redefining motorsport with a bold focus on innovation and...SuggestedPermanent employmentTemporary workWork at officeFlexible hours3 days per week
Tesla
United Kingdom18 days ago - .... While protecting digital identities is at the core of our technology, protecting individual identities is at the core of our culture... ...digital experiences, and identity and access management. As Risk Manager, you will lead the identification, assessment, treatment...SuggestedFull timeLocal areaWorldwideFlexible hours
Ping Identity
United Kingdom19 days ago - ...As Senior Risk Manager , you will play a critical role in protecting Zodia Custody's business, clients and reputation while supporting... ...in a high-growth fintech, digital asset or regulated technology environment. Professional risk or digital assets certifications...SuggestedFull timeSeasonal workImmediate startFlexible hours
Zodia Custody
United Kingdom15 days ago - ...building it. What we are looking for We are seeking a Head of Risk to own and develop the Firm’s risk function end-to-end. This is... ...or co-designing firm-wide risk systems, working closely with technology (CIO) and operations (COO) to translate risk requirements into...SuggestedFull timeContract workRemote workFlexible hours
Keyrock
United Kingdom17 days ago - ...innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career. Join MUFG... ...financial institution, is seeking a Head of Financial Risk, Director to join their London team. This pivotal role offers you the...SuggestedFull timeWork at officeFlexible hours
MUFG Bank, Ltd.
United Kingdom19 days ago - ...Founded in 2011, Fasanara is a global asset manager and technology platform. We manage c. USD 6 billion AUM (as of December 31, 2025) in... ...and other functionality to reduce manual work and operational risk. Continuously look for opportunities to automate, simplify and...Full time
Fasanara Capital
United Kingdom19 days ago - ...agility. This means investing in talent, technologies, and tools that empower you to own your... ...is seeking an Assistant Vice President, Risk and Legal Audit to join their EMEA Internal... ...with Senior Audit Managers/Audit Directors to ensure the audit portfolio remains relevant...Full timeInterim roleWork at officeWorldwideFlexible hours
MUFG Bank, Ltd.
United Kingdom10 days ago £6,000 per month
...We are seeking an experienced Investor for a 6-month contract to support our early-stage investment activities in the health technology sector. This is an opportunity to work with cutting-edge startups addressing critical healthcare challenges and contribute to shaping...Full timeContract workWork at officeRemote workFlexible hours2 days per weekFounders Factory
United Kingdom11 days ago$100 per hour
Compensation $100/hour Commitment: Flexible, 5-20 hours per week (or more if desired) Location: Fully remote, work on your own schedule Start date: ASAP Qualifications 3+ years in an investing role at a venture capital or growth equity fund Experience...Temporary workImmediate startRemote workFlexible hoursEthos
United Kingdom2 days ago$80 per hour
...remote, work on your own schedule Start date: ASAP Qualifications 4+ years as an Enterprise Solutions Consultant at a top technology company Deep expertise in translating technical solutions into executive-ready slides Expert-level PowerPoint and slide...Hourly payTemporary workImmediate startRemote workFlexible hoursEthos
United Kingdom2 days ago- ...Dynamics Mission Systems engineers a diverse portfolio of high technology solutions, products and services that enable customers to successfully... ...data extraction and reporting to identify workforce trends, risks, opportunities, and predictive insights that support strategic...Full timeFlexible hours2 days per week
- ...Founded in 2011, Fasanara Capital is a London-headquartered, technology-driven alternative asset manager with approximately USD 7.5 billion... ...overdue receivables, disputes, dilution and concentration risks, and escalate material exceptions. Produce operational reporting...Full timeTemporary workWork at office
$80 per hour
Generalist Investor Presentation Designer Expert Ethos ⢠Remote Education Not stated Type Hourly Pay Rate $80/hr Listed 40d ago â How Ethos hiring works Your application is a 10-minute call. Ethos's AI interviewer asks about...Hourly payContract workImmediate startRemote workFlexible hoursEthos
United Kingdom7 days ago
Do you want to receive more vacancies?
Subscribe and receive similar vacancies to Director, Technology Risk. Be the first to apply!
Related searches