Director, Technology Risk

The Digital Asset Risk & Compliance team is looking for a Director, Technology Risk to lead the Second Line build-out of technology and information security (Info Sec) risk oversight for Mastercard's digital asset strategy, products and operations. The role will align BVNK's First- and Second-Line approach with Mastercard's Technology Risk and Info Sec standards, leveraging industry frameworks such as UCF, the CRI Profile, NIST CSF, ISO 27001, CSA Cloud Controls Matrix (CCM), SOC, PCI DSS, FAIR and RCSA, while incorporating considerations unique to digital assets such as custody models, blockchain infrastructure, smart-contract dependencies and third-party integrations.

The role requires the ability to operate in a fast-moving integration environment, distinguish material technology risks from execution noise, and provide specialist oversight of digital-asset infrastructure with independent challenge of First Line risk assessments, control design and remediation. Role:
Technology & Info Sec Risk Framework (2

LoD Build-Out)

• Lead the Second Line implementation and coordination of a Technology Control Framework aligned to Mastercard standards - leveraging UCF, the CRI Profile, NIST CSF, ISO 27001, SOC, PCI DSS, FAIR and RCSA - incorporating risks unique to digital asset environments, and aligned with BVNK's First Line approach.
• Support integration of continuous control monitoring (CCM) approaches and tools with more traditional control testing and assurance.
• Define risk taxonomy, assessment methodology, control standards and governance routines specific to digital-asset technology and security risk.
• Drive establishment of a 1
  
  LoD Control Library that aligns to the coordinated Technology Control Framework.
• Connect technology risk assessments, control libraries, risk appetite, risk registers and governance reporting into a single, coherent oversight view, and align decision-making to Mastercard's Risk Appetite Framework, including risk objectives and measurable tolerances.

• Provide specialist Second Line oversight of digital-asset infrastructure, including custody architecture, wallet design (hot/cold/multi-sig), blockchain network integrations, node and validator operations, cloud hosting and third-party/vendor dependencies.
• Maintain a current view of technology architecture, dependencies and risk exposures across Mastercard's and BVNK's digital-asset platforms.
• Assess the technology and security implications of new digital-asset products, integrations and chain/network additions before launch.
• Identify and escape emerging technology and infrastructure risks, including custodial key compromise, smart-contract failure and third-party concentration risk.
• Provide Second Line oversight and subject-matter expertise on cryptographic risks across supported blockchain networks, including key management and the control environment protecting digital assets held in wallets and custody solutions.

• Challenge First Line technology and security teams on risk assessments, control design, risk ratings, risk acceptances, issues and remediation plans.
• Perform sample-based control validation on critical services and key business units - including cloud infrastructure environments, digital asset infrastructure such as wallets, custody and blockchain integrations - to assess control design and effectiveness, remaining independent from the broader QA/testing function.
• Support risk acceptance processes for BVNK, including review, challenge and escalation of material accepted risks to relevant governance forums.
• Track open issues, risk acceptances and remediation commitments to closure, escalating overdue or high-risk items through governance.
• Represent Technology Risk in relevant governance forums and contribute to effective risk-based decision-making across technology, security and product stakeholders.
• Partner with Info Sec, Technology Risk, Compliance and Audit to ensure consistent application of standards and avoid duplicative or conflicting oversight., All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:
• Abide by Mastercard's security policies and practices;
• Ensure the confidentiality and integrity of the information being accessed;
• Report any suspected…