Director, Services Technology Risk

Mastercard•Remote - California, CA

6d•$142,000 - $234,000•Remote

About The Position

The Director, Services Technology Risk will lead identification, assessment, prioritization, monitoring, and escalation of technology and operational risks across Services. The role establishes risk management strategies, frameworks, operating models, governance, and capabilities, including risk registers, product risk assessments, Risk and Control Self-Assessments (RCSAs), and processes for risk acceptance and escalation. It maintains a consolidated view of material risks across Services products, platforms, and programs, with clear ownership and visibility into exposure, treatment, and status. The Director partners with Product, Engineering, Security, Business, and enterprise risk teams to embed risk management into business and technology processes, reinforce accountability, and provide effective challenge on material and emerging risks. The role modernizes risk identification and assessment through automation, analytics, and AI-enabled capabilities, and translates complex technical risks into business impacts, tradeoffs, and actionable insights for leadership. It also leads and develops a team of technology risk professionals. The role requires significant experience in technology or related risk disciplines, strong business judgment, the ability to influence senior stakeholders, and experience building scalable practices in complex or evolving environments. A bachelor’s degree is required. Professional certifications such as CISA, CISSP, CRISC, or CISM are preferred but not required. The posting lists a remote California base salary range of $142,000–$234,000 USD. Mastercard intends to fill the position by 01/18/2027, or as soon as possible if that date has passed.

Requirements

Significant experience in technology risk management, operational risk, information security risk, technology audit, technology controls, or a related discipline.
Experience leading and maturing technology risk management practices across complex products, platforms, and business environments, including risk registers, product risk assessments, RCSAs, or similar activities.
Ability to navigate ambiguity, resolve competing priorities, and create structure where processes are not mature.
Strong understanding of technology risks, including cybersecurity, data protection, software development, cloud services, identity and access management, vulnerability management, change management, third-party risk, and operational resilience.
Ability to understand complex technology architectures and translate technical risks into business impacts and decision points.
Familiarity with regulatory expectations and data-residency requirements related to technology controls, and frameworks such as NIST, ISO 27001, and COBIT.
Strong business judgment and ability to assess risk, challenge assumptions, evaluate tradeoffs, and provide practical recommendations.
Demonstrated ability to influence senior Product, Engineering, Business, Security, and risk stakeholders.
Ability to build practical, scalable operating models in complex or evolving environments.
Proven experience leading, coaching, and developing high-performing teams.
Strong written and verbal communication skills, including communicating complex risk matters to technical and non-technical audiences.
Bachelor’s degree required.

Nice To Haves

Strong interest in automation, analytics, and AI-enabled approaches to modernizing risk management.
Professional certifications such as CISA, CISSP, CRISC, CISM, or equivalent; preferred but not required.

Responsibilities

Lead the strategy, operating model, governance, and capabilities for identifying, assessing, prioritizing, monitoring, and managing technology and operational risks across Services.
Establish and mature standardized risk management practices, including risk registers, product risk assessments, RCSAs, and risk acceptance and escalation.
Modernize and scale risk identification and assessment using automation, analytics, and AI-enabled capabilities.
Maintain a consolidated view of material risks across Services products, platforms, and programs, including ownership, accountability, exposure, treatment, and status.
Partner with Product and Engineering leaders to embed risk identification and assessment in business and technology processes and reinforce accountability throughout the risk lifecycle.
Provide risk challenge and judgment on material and emerging risks, including cybersecurity, resilience, regulatory, operational, AI/ML, and generative AI risks.
Establish governance for residual risk acceptance and escalation, ensuring decisions are transparent, appropriately approved, aligned with risk appetite and tolerance, and supported by ownership and rationale.
Translate complex technology risks into business impacts, tradeoffs, and actionable insights for leadership decision-making, prioritization, investment, and remediation.
Provide Services leadership with an integrated view of risk profiles, including material exposures, emerging and accepted risks, trends, and areas needing management attention.
Partner across Engineering, Product, Security, Business, and enterprise risk functions to promote consistent practices and reduce fragmentation and duplication.
Lead, coach, and develop a team of technology risk professionals, fostering sound judgment, constructive challenge, accountability, and trusted partnerships.

Benefits

Medical, prescription drug, dental, vision, disability, and life insurance
Flexible spending account and health savings account
Paid leaves, including 16 weeks of new parent leave and up to 20 days of bereavement leave
80 hours of Paid Sick and Safe Time
25 days of vacation time and 5 personal days, prorated based on date of hire
10 annual paid U.S. observed holidays
401(k) with a company match
Deferred compensation for eligible roles
Fitness reimbursement or on-site fitness facilities
Tuition reimbursement eligibility
May be eligible for an annual bonus or commissions depending on the role