Director, Technology Risk

Our Purpose Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential. Title and Summary Director, Technology Risk Director, Second Line of Defense - Technology Risk Overview: • Provide independent second-line oversight, review, and validation of technology risks across markets, with a focus on Europe, ensuring alignment with IT policies, standards, controls, and regulatory expectations. • Support maintenance of a technology risk management framework aligned with regulatory requirements and Mastercard’s Enterprise Risk Management and Operational Risk and Control frameworks. • Support development of a control framework aligned with approved risk appetite, regulatory obligations, and technology risk exposure. • Review risk and technology-related regulatory requirements and assess the adequacy of management responses to supervisory inspections and feedback. • Lead the development of clear, decision-useful risk reporting for market and Group governance forums, supporting effective escalation and transparency.

Technology Risk Oversight in Market: • Provide independent second line oversight and constructive review of market (Europe) relevant risks and risk assessment activities focusing on Operational Resilience and Security risks, this includes risk assessments related to material product and technology changes. • Provide second line oversight across key control areas focusing on technology (such as change management, system availability, security, access, and data), reviewing control design, assessing operational effectiveness, and examining control testing results and assurance outcomes. Identifies, highlights and escalates material control deficiencies and remediation delays. • Ensure documentation and ongoing monitoring of market relevant risks focused on technology risks, controls, and issues, including security testing results, through remediation to closure in approved GRC tools. • Support and review security and resilience frameworks and strategies, ensuring they address threats and vulnerabilities specific to market’s specific processes, products and services. • Ensures technology teams develop policies and standards specific to the local market, reducing risk exposure and promoting the implementation of robust IT and security controls. • Oversee the development of relevant metrics focused on technology and security risk metrics, ensuring they are risk meaningful and outcomes focused, and aligned with approved risk appetite and tolerance thresholds. Risk Management Framework: • Maintain and support the adoption of the Technology Risk Standard in markets and technology and contribute to the design and delivery of supporting processes and tools that meet local regulatory requirements. • Support the execution of the Enterprise Risk Management (ERM) and Operational Risk and Controls (ORC) Framework in market and technology groups. • Develop and manages local risk processes, ensuring best practices are followed and that all procedures are documented, reviewed, and refreshed regularly. • Support maintaining a control framework in coordination with Group First line of defense Technology and Security Risk teams. Technology Risk Governance: • Act as the 2LOD Risk representative at governance forums, risk committees, and senior management discussions, providing clear, evidence-based insights to support effective decision making. • Review the effectiveness of risk reporting (focusing on technology risk) to management and governance committees and