{"id":938694,"url":"https://alion.io/job/tabby-vendor-risk-manager","title":"Senior Analyst, Vendor Management","company":{"id":255,"name":"Tabby","domain":"tabby.ai","url":"https://alion.io/company/tabby","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Pinpoint","truth_index":{"grade":"B","score":83,"open_postings":4,"ghost_share":0.25,"stale_share":0,"repost_share":0.5,"time_to_fill_p50_days":15,"computed_at":"2026-11-06T05:58:05Z"}},"role":"Analytics","role_family":"Analytics","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Riyadh, Saudi Arabia"],"countries":["SA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":23000,"max_usd":69000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":3248},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-09-14T15:55:26Z","employer_posted_date":"2026-11-02","last_verified_at":"2026-11-06T05:24:29Z","board_verified":true,"closed_at":null,"days_open":52,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":52},"description":"BNPL businesses don't run on a single core system - they run on a chain of vendors: KYC providers doing identity\nchecks in milliseconds, bureau data feeding underwriting decisions, processors moving money at checkout, and\ncollections agencies chasing missed payments on our behalf. When any link in that chain fails, it isn't an internal\ninconvenience - it's a customer who can't check out, a credit decision made on bad data, or a regulator asking why\na critical service went down with no warning.\nAs Vendor Risk Manager, you will own our third-party risk program end to end, from the first due diligence\nquestionnaire to the day a vendor is offboarded. You will be the person who can tell leadership, in plain terms,\nwhich vendors carry the most risk and why, and you will make sure vendor failures never become customer failures.\nKey Responsibilities\nDue Diligence & Onboarding\nRun due diligence on new vendors before contracts are signed, including financial health checks, SOC 2 / ISO 27001 review, breach history, and subprocessor mapping.\nIssue a clear risk rating for every prospective vendor, with conditions attached rather than a simple pass orfail, covering KYC, identity verification, fraud detection, credit bureau, payment processing, card issuing,\nbanking, and collections partners.\n\nSit inside the contracting process with Legal and Procurement to secure the terms that matter: audit rights,breach notification windows, data localization commitments, exit assistance clauses, and SLAs tied to real penalties.\n\nRisk Assessment & Ongoing Monitoring\nOwn vendor risk assessments across our active third-party portfolio, prioritizing critical and high-risk vendors for annual deep-dive reviews.\nBuild and run tiered monitoring cadences - quarterly for critical vendors such as KYC, payment processing, and banking partners, annual for the rest - tracking control drift, subprocessor changes, andadverse media.\n\nMaintain the concentration risk and critical-vendor register, and be ready to explain single points of failure, such as one bureau covering the majority of underwriting volume, and what the contingency plan actuallyis.\n\nCross-Functional Partnership\nWork with Product before new vendor integrations go live - you're in the room when a new checkout partner or fraud model vendor is being evaluated, not brought in after the contract is signed.Prepare vendor risk reporting for the Risk Committee and Board, translating control gaps and incident\ntrends into decisions leadership can act on.\n\n Offboarding & Exit Management\nManage the offboarding process for exited vendors, confirming data deletion, access revocation, and transition continuity for anything customer-facing.\nEnsure regulatory and contractual exit obligations are met and documented, particularly for vendorsclassified as critical or important.\n\nSkills, Knowledge & Expertise\n3-4 years in third-party risk management, vendor risk, or operational risk, ideally at a payments company, lender, bank, or fintech where vendor failure has direct customer or regulatory consequences.\nWorking knowledge of NIST CSF, ISO 27001, SOC 2, and standardized assessment tools like SIG orCAIQ - you know how to read a SOC 2 report and spot what's missing, not just file it away.\n\nFamiliarity with the regulatory landscape vendors sit inside: consumer credit rules, data privacy obligations(GDPR/CCPA depending on footprint), PCI-DSS for anything touching card data, and\noutsourcing/operational resilience expectations for critical third parties.\n\nComfort negotiating directly with vendors - you've pushed back on a processor's standard MSA, gotten afraud vendor to commit to a real SLA, and know when “our legal team will follow up” means the deal\nneeds to walk.\n\nAbility to translate risk findings for people who don't think in risk terms, including explaining to acommercial lead why a cheaper KYC vendor isn't worth the onboarding delay it will cause six months later.\n\nStrong analytical skills with the ability to interpret vendor performance and control data to supportoperational decisions.\n\nExcellent communication and interpersonal skills, with the ability to interact effectively across all levels ofthe organization.\n\nFull professional proficiency in English required; Arabic is a plus.\n Nice to have:\nDirect BNPL or consumer credit experience - you've worked with bureau data, alternative credit scoring\nvendors, or collections agencies specifically.\nHands-on experience with a GRC platform such as OneTrust, ProcessUnity, or Archer for assessment\nworkflows and vendor inventory.\nCTPRP, CRISC, CISA, or CISM certification.","description_format":"text","description_chars":4602,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Buy Now, Pay Later"],"lifecycle":[{"event":"open","at":"2026-09-15T15:55:26Z"}],"visa":[],"liveness":{"score":15,"band":"cold","label":"Long shot","p_open":1,"p_active":0.419,"p_room":0.35,"age_days":52,"expected_fill_days":15,"reasons":["conf:0","velocity","win:tail"],"computed_at":"2026-11-06T05:58:05Z"},"pay":null,"html_url":"https://alion.io/job/tabby-vendor-risk-manager","json_url":"https://alion.io/job/tabby-vendor-risk-manager.json","meta":{"generated_at":"2026-11-06T07:36:49Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13553,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":255},"rest":"https://alion.io/mcp/rest/get_company?id=255"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftabby-vendor-risk-manager"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftabby-vendor-risk-manager"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftabby-vendor-risk-manager"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/tabby-vendor-risk-manager\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftabby-vendor-risk-manager"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":938694}},{"tool":"search_jobs","arguments":{"company":"tabby.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":938694},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}