Lead Technology Risk Analyst

• Perform technology control testing and execute assurance programs (e.g., ISO, PCI DSS, SOC 2), partnering with stakeholders to support audit readiness, evidence management, and closure of control gaps
• Advise and assist with the implementation of technology and information security policies and strategies, promoting a culture of risk awareness and compliance
• Support the optimization of technology risk and controls activities to demonstrate technology compliance across multiple markets, leveraging common elements and focusing on reusability
• Identify opportunities within the risk management lifecycle for automation, leveraging existing service operations tools to drive efficiency and consistency across the business
• Maintain and enhance templates used for risk management activities, such as risk assessments and risk and control self-attestations, based on industry best practices
• Collaborate with technology partners - Engineering, Business Operations, Security Leads, and Risk Management teams to understand and translate technology and security risk management requirements, perform gap analysis, provide recommendations, and assist in developing remediation plans
• Assist with the design and implementation of controls to demonstrate compliance with technology and security standards and associated control requirements, supporting remediation approaches to ensure tracking and closure of gaps
• Evaluate the current state of controls in relation to industry best practices and Mastercard standards, providing recommendations to enhance controls maturity
• Share best practices and leverage trend analysis to execute business and cross-functional strategies around managing obligations
• Report on technology and security risk and compliance trends, assisting in risk treatment, including exception and escalation awareness

• Strong foundation of risk management fundamentals, lifecycle and processes (e.g., methods for identifying, assessing, treating, and monitoring risk)
• Prior experience executing Tech risk and control activities (e.g., RCSA, Internal/external audits, risk assessments, SOC2/ISO/PCI) in first, second or third line of defense
• Background in technology audit, risk management, technology operations, information systems management, information security management, etc.
• Strong knowledge of baseline technology and security processes, risks, and controls. Tech and Information Security control testing experience preferred
• Familiarity with technology/security frameworks and mechanisms (e.g., SOC 1, SOC 2, PCI-DSS, ISO 27001, COBIT, CRI)
• Understanding of regulatory technology and security risk management expectations
• Knowledge of current and emerging technologies and their potential for exploitation
• Experience collaborating cross-functionally and geographically to identify and implement best practice risk processes
• Systematic problem-solving approach, coupled with strong communication skills and a sense of ownership to drive results

Tech and Information Security control testing experience