Manager, Technology Control Testing, Services Technology Risk

Mastercard•New York, NY

6d•$131,000 - $216,000

About The Position

The Manager, Technology Control Testing will lead and build the first-line technology control testing function within Mastercard’s Services Technology Risk team. The role owns the design and execution of a risk-based annual control testing plan across Services products and platforms, while setting the function’s methodology, standards, and quality bar. It combines hands-on testing with people leadership, including developing a direct report and overseeing consultant resources as needed. The manager will perform end-to-end testing in complex, multi-layered environments, distinguishing controls owned by products from those inherited from shared platforms. The role also involves judgment-based scoping, clear reporting of results and risks, and partnership with engineering teams to improve the program and advance feasible automation, including AI-enabled approaches. The function is intended to strengthen engineering practices, control effectiveness, resiliency, regulatory confidence, and customer trust. Mastercard describes itself as a global technology company in the payments industry, operating in more than 200 countries and territories and working to support an inclusive, sustainable digital economy. The posting states that the role is intended to be filled by January 18, 2027, or as soon as possible if that date has passed. For New York City, the listed base salary range is $131,000–$216,000 USD. Eligible employees may also receive an annual bonus or commissions depending on the role.

Requirements

Deep expertise in technology risk management, technology audit, IT controls testing, information security, or a related discipline.
Experience managing people, or demonstrated experience leading, coaching, and reviewing the work of others, including consultants or third-party resources.
Proven experience designing, executing, and maturing a risk-based control testing program or annual test plan.
Strong hands-on experience performing Test of Design and Test of Operating Effectiveness, including writing test scripts and documenting workpapers and observations.
Strong knowledge of technology controls, including encryption configuration, logging and monitoring, software development lifecycle, change management, identity and access management, vulnerability management, and operational resiliency.
Ability to understand complex, multi-layered technical architectures, including shared platforms and products built on them, and determine control ownership.
Familiarity with regulatory expectations and data-residency requirements as they apply to technology controls, and with frameworks such as NIST, ISO 27001, and COBIT.
Sound judgment in scoping and prioritization, and ability to explain and defend risk-based decisions under resource and timeline constraints.
Strong interest in automation and AI, with experience identifying automation opportunities and partnering with engineering teams to deliver them.
Strong verbal and written communication skills, including presenting status, issues, and recommendations to technical and non-technical audiences and senior leadership.
Ability to build trusted relationships and influence stakeholders across Engineering, Product, Security, and business teams.
Comfort navigating ambiguity and building processes where none exist, with a strong sense of ownership and accountability.
Bachelor’s degree required.

Nice To Haves

Professional certification such as CISA, CISSP, CRISC, or CIA.

Responsibilities

Build, own, and execute a risk-based annual control testing plan for Services products and platforms, reassessing shortcomings and scaling the plan as scope grows.
Lead, coach, and develop direct reports by setting objectives, assigning and balancing work, managing performance, and reviewing work for quality and completeness.
Oversee consultant resources as scope requires.
Perform hands-on, end-to-end technology control testing in complex environments and distinguish product-level controls from platform-level controls.
Scope controls using available risk data, indicators, and prior findings, and document judgment-based decisions that account for capacity, effort, and turnaround times.
Incorporate regulatory and data-residency requirements into test planning and execution to cover the end-to-end control lifecycle.
Develop and maintain repeatable Test of Design (TOD) and Test of Operating Effectiveness (TOE) scripts and documentation standards.
Communicate testing results, control gaps, and practical recommendations, and build stakeholder alignment on risk and remediation.
Partner with the internal issue management team to raise and document issues in accordance with established requirements.
Escalate risks, blockers, and disputed results to leadership at appropriate times.
Report testing status, blockers, and path to green accurately to leadership and stakeholders.
Identify testing-cycle automation opportunities, assess feasibility, and partner with engineering teams and leadership to advance approaches, including AI-enabled solutions.
Promote a culture in which control testing strengthens resiliency, regulatory confidence, and customer trust.

Benefits

Medical, prescription drug, dental, vision, disability, and life insurance.
Flexible spending account and health savings account.
Paid leaves, including 16 weeks of new parent leave and up to 20 days of bereavement leave.
80 hours of Paid Sick and Safe Time.
25 days of vacation time and 5 personal days, prorated based on date of hire.
10 annual paid U.S. observed holidays.
401(k) with a company match.
Deferred compensation for eligible roles.
Fitness reimbursement or access to on-site fitness facilities.
Tuition reimbursement eligibility.
May be eligible for an annual bonus or commissions depending on the role.