Vendor Risk Manager

• Work with Product before new vendor integrations go live — you're in the room when a new checkout partner or fraud model vendor is being evaluated, not brought in after the contract is signed.
• Prepare vendor risk reporting for the Risk Committee and Board, translating control gaps and incident trends into decisions leadership can act on.

• Manage the offboarding process for exited vendors, confirming data deletion, access revocation, and transition continuity for anything customer-facing.
• Ensure regulatory and contractual exit obligations are met and documented, particularly for vendors classified as critical or important.

• 3–4 years in third-party risk management, vendor risk, or operational risk, ideally at a payments company, lender, bank, or fintech where vendor failure has direct customer or regulatory consequences.
• Working knowledge of NIST CSF, ISO 27001, SOC 2, and standardized assessment tools like SIG or CAIQ — you know how to read a SOC 2 report and spot what's missing, not just file it away.
• Familiarity with the regulatory landscape vendors sit inside: consumer credit rules, data privacy obligations (GDPR/CCPA depending on footprint), PCI-DSS for anything touching card data, and outsourcing/operational resilience expectations for critical third parties.
• Comfort negotiating directly with vendors — you've pushed back on a processor's standard MSA, gotten a fraud vendor to commit to a real SLA, and know when “our legal team will follow up” means the deal needs to walk.
• Ability to translate risk findings for people who don't think in risk terms, including explaining to a commercial lead why a cheaper KYC vendor isn't worth the onboarding delay it will cause six months later.
• Strong analytical skills with the ability to interpret vendor performance and control data to support operational decisions.
• Excellent communication and interpersonal skills, with the ability to interact effectively across all levels of the organization.
• Full professional proficiency in English required; Arabic is a plus.

Nice to have:

• Direct BNPL or consumer credit experience — you've worked with bureau data, alternative credit scoring
• vendors, or collections agencies specifically.
• Hands-on experience with a GRC platform such as OneTrust, ProcessUnity, or Archer for assessment
• workflows and vendor inventory.
• CTPRP, CRISC, CISA, or CISM certification.