Director, Technology Risk

Our Purpose

Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.

Title and Summary

Mastercard is a global technology company in the payments sector. We power payments and provide products and services for individuals and industries all around the world. Our people, technology, data and brand provide the capabilities that drive our success. We believe in connecting people to priceless possibilities.

As a company, we know that our success is driven by the skills, experience, integrity and mindset of the talent we hire. By building an inclusive, world-class culture, our employees have once-in-a-career opportunities to be a part of teams that have a greater impact on our community and our world. We invite you to join our team to find out how you too can start something priceless.

Overview:

The Digital Asset Risk & Compliance team is looking for a Director, Technology Risk to lead the Second Line build-out of technology and information security (InfoSec) risk oversight for Mastercard’s digital asset strategy, products and operations. The role will align BVNK’s First- and Second-Line approach with Mastercard’s Technology Risk and InfoSec standards, leveraging industry frameworks such as UCF, the CRI Profile, NIST CSF, ISO 27001, CSA Cloud Controls Matrix (CCM), SOC, PCI DSS, FAIR and RCSA, while incorporating considerations unique to digital assets such as custody models, blockchain infrastructure, smart-contract dependencies and third-party integrations. The role requires the ability to operate in a fast-moving integration environment, distinguish material technology risks from execution noise, and provide specialist oversight of digital-asset infrastructure with independent challenge of First Line risk assessments, control design and remediation.

Role:

Technology & InfoSec Risk Framework (2LoD Build-Out)

• Lead the Second Line implementation and coordination of a Technology Control Framework aligned to Mastercard standards - leveraging UCF, the CRI Profile, NIST CSF, ISO 27001, SOC, PCI DSS, FAIR and RCSA - incorporating risks unique to digital asset environments, and aligned with BVNK’s First Line approach.
• Support integration of continuous control monitoring (CCM) approaches and tools with more traditional control testing and assurance.
• Define risk taxonomy, assessment methodology, control standards and governance routines specific to digital-asset technology and security risk.
• Drive establishment of a 1LoD Control Library that aligns to the coordinated Technology Control Framework.
• Connect technology risk assessments, control libraries, risk appetite, risk registers and governance reporting into a single, coherent oversight view, and align decision-making to Mastercard's Risk Appetite Framework, including risk objectives and measurable tolerances.

Digital-Asset Infrastructure Oversight

• Provide specialist Second Line oversight of digital-asset infrastructure, including custody architecture, wallet design (hot/cold/multi-sig), blockchain network integrations, node and validator operations, cloud hosting and third-party/vendor dependencies.
• Maintain a current view of technology architecture, dependencies and risk exposures across Mastercard’s and BVNK’s digital-asset platforms.
• Assess the technology and security implications of new digital-asset products, integrations and chain/network additions before launch.
• Identify and escalate emerging technology and infrastructure risks, including custodial key compromise, smart-contract failure and third-party concentration risk.
• Provide Second Line oversight and subject-matter expertise on cryptographic risks across supported blockchain networks, including key management and the control environment protecting digital assets held in wallets and custody solutions.

Independent Challenge, Control Validation & Remediation

• Challenge First Line technology and security teams on risk assessments, control design, risk ratings, risk acceptances, issues and remediation plans.
• Perform sample-based control validation on critical services and key business units - including cloud infrastructure environments, digital asset infrastructure such as wallets, custody and blockchain integrations - to assess control design and effectiveness, remaining independent from the broader QA/testing function.
• Support risk acceptance processes for BVNK, including review, challenge and escalation of material accepted risks to relevant governance forums.
• Track open issues, risk acceptances and remediation commitments to closure, escalating overdue or high-risk items through governance.
• Represent Technology Risk in relevant governance forums and contribute to effective risk-based decision-making across technology, security and product stakeholders.
• Partner with InfoSec, Technology Risk, Compliance and Audit to ensure consistent application of standards and avoid duplicative or conflicting oversight.

All About You:

• Experience in technology risk, cyber risk, operational resilience, control assurance or second line technology oversight within a large, regulated financial services, payments, fintech or technology environment.
• Experience and working knowledge of modern cloud (e.g. AWS / GCP) hosted infrastructure and networks and knowledge
• Experience with continuous control monitoring tools
• Demonstrated ability to design, implement and embed technology control frameworks that are practical, risk-based and aligned to business outcomes - not just compliance checklists.
• Ability to translate industry standards such as UCF, CRI Profile, NIST CSF, ISO 27001, SOC, PCI DSS, RCSA and FAIR into a coherent control framework that supports governance, assurance and risk appetite decisions.
• Working knowledge of blockchain infrastructure, digital-asset custody models, wallet architecture and related technology dependencies, or strong aptitude to build this quickly.
• Working knowledge of cryptographic practices that underpin blockchain and digital assets
• Strong understanding of Second Line oversight, independent challenge, risk appetite and the Three Lines of Defense model.
• Experience partnering with First Line technology, product, engineering, security and operations teams on risk assessments, control design, issue management and remediation - influencing without direct authority while maintaining independence.
• Ability to perform targeted, sample-based control validation while maintaining independence from broader QA/testing functions.
• Comfortable operating in high-growth, fast-moving integration environments where processes are evolving and documentation may be incomplete - building a function from the ground up and driving execution in ambiguity.
• Rigorous without being bureaucratic - applies control expectations proportionately to strengthen the business while avoiding unnecessary friction.

• Clear communicator who can translate complex technical risk into decision-ready material, risk implications and actions for senior stakeholders.

Corporate Security Responsibility

All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:

• Abide by Mastercard’s security policies and practices;

• Ensure the confidentiality and integrity of the information being accessed;

• Report any suspected information security violation or breach, and

• Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.