Our Purpose

Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.

Title and Summary

Manager, Technology Control Testing, Services Technology Risk

Who is Mastercard?

Mastercard is a global technology company in the payments industry. Our mission is to connect and power an inclusive, digital economy that benefits everyone, everywhere by making transactions safe, simple, smart, and accessible. Using secure data and networks, partnerships and passion, our innovations and solutions help individuals, financial institutions, governments, and businesses realize their greatest potential.

Our decency quotient, or DQ, drives our culture and everything we do inside and outside of our company. With connections across more than 210 countries and territories, we are building a sustainable world that unlocks priceless possibilities for all.

Overview:
The Services Technology Risk team is looking for a Manager, Service Technology Risk professional, to help maintain secure, resilient, and trusted technology environments while enabling innovation and growth.

The ideal candidate is a practical, risk-focused leader who sees control testing as a source of insight, not a checklist exercise. They bring a continuous improvement mindset, using lessons learned and testing observations to make the program more efficient each cycle, and partnering with engineering teams to identify, assess, and advance opportunities to automate testing, including AI-enabled approaches, as the function matures and scales controls, and build secure, resilient technology solutions at scale. They view compliance and assurance not as a check-the-box exercise, but as an opportunity to strengthen engineering practices, improve control effectiveness, and enable the business to move faster with confidence.

Role:
The Manager, Technology Control Testing will lead and build out the first-line technology control testing function within Services Technology Risk. This hands-on people leader will own the design and execution of a risk-based annual control testing plan across products and platforms in the Services organization, while managing and developing a direct report and overseeing consultant resources as scope requires.
This role is ideal for someone with deep experience executing end-to-end technology control testing across complex, multi-layered environments, who can clearly distinguish controls owned by a product from those inherited from shared platforms. The successful candidate will be comfortable performing testing directly while setting the methodology, standards, and quality bar for the function, applying sound judgment to scoping decisions, and communicating clearly with stakeholders and leadership on status, risks, and results.
The Manager, Technology Control Testing, Services Technology Risk will:
• Build, own, and execute a risk-based annual control testing plan for products and platforms across the Services organization, reassessing the approach where shortcomings are identified and scaling it as scope grows year over year.
• Lead, coach, and develop direct reports, including setting objectives, assigning and balancing work, managing performance, and reviewing testing work for quality and completeness.
• Perform hands-on, end-to-end technology control testing across complex environments, identifying and differentiating controls owned at the product level from those owned at the platform level.
• Conduct control scoping using available risk data, indicators, and prior findings, and apply documented, judgment-based rationale to scoping decisions that account for resource capacity, level of effort, and request turnaround.
• Incorporate regulatory and data-residency requirements (e.g., in-country or on-soil data processing obligations) into test planning and execution to ensure proper coverage of the end-to-end control lifecycle.
• Develop and maintain clear, repeatable test scripts for both Test of Design (TOD) and Test of Operating Effectiveness (TOE), establishing documentation standards for the function.
• Communicate testing results, control gaps, and practical recommendations to stakeholders, building alignment on risk and remediation.
• Partner with the internal issue management team to raise and document issues in alignment with established issue management requirements.
• Determine the appropriate points and timing for escalation, raising risks, blockers, and disputed results to leadership promptly.
• Accurately report testing status, blockers, and path to green to leadership and stakeholders.
• Identify opportunities to automate testing throughout the testing cycle, perform feasibility assessments, and partner with engineering teams and leadership to present and advance automation approaches, including AI-enabled solutions.
• Promote a culture where control testing is viewed as a business enabler that strengthens resiliency, regulatory confidence, and customer trust.

All About You
• Deep expertise in technology risk management, technology audit, IT controls testing, information security, or related disciplines.
• Experience managing people, or demonstrated experience leading, coaching, and reviewing the work of others, including consultants or third-party resources.
• Proven experience designing, executing, and maturing a risk-based control testing program or annual test plan.
• Strong hands-on experience performing Test of Design and Test of Operating Effectiveness, including writing test scripts and documenting workpapers and observations.
• Strong knowledge of technology controls across areas such as encryption configuration, logging and monitoring, software development lifecycle, change management, identity and access management, vulnerability management, and operational resiliency.
• Ability to understand complex, multi-layered technical architectures, including shared platforms and the products built on them, and to determine where control ownership sits.
• Familiarity with regulatory expectations and data-residency requirements as they apply to technology controls, and with frameworks such as NIST, ISO 27001, and COBIT.
• Sound judgment in scoping and prioritization, with the ability to explain and defend risk-based decisions under resource and timeline constraints.
• Strong interest in automation and AI, with experience identifying automation opportunities and partnering with engineering teams to deliver them.
• Strong verbal and written communication skills, with the ability to present status, issues, and recommendations to technical and non-technical audiences, including senior leadership.
• Ability to build trusted relationships and influence stakeholders across Engineering, Product, Security, and business teams.
• Comfortable navigating ambiguity and building processes where none exist, with a strong sense of ownership and accountability.
• Bachelor’s degree required.
• Professional certifications such as CISA, CISSP, CRISC, or CIA preferred but not required.

Mastercard is a merit-based, inclusive, equal opportunity employer that considers applicants without regard to gender, gender identity, sexual orientation, race, ethnicity, disabled or veteran status, or any other characteristic protected by law. We hire the most qualified candidate for the role. In the US or Canada, if you require accommodations or assistance to complete the online application process or during the recruitment process, please contact [email protected] and identify the type of accommodation or assistance you are requesting. Do not include any medical or health information in this email. The Reasonable Accommodations team will respond to your email promptly.

Corporate Security Responsibility

All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:

• Abide by Mastercard’s security policies and practices;

• Ensure the confidentiality and integrity of the information being accessed;

• Report any suspected information security violation or breach, and

• Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.

In line with Mastercard’s total compensation philosophy and assuming that the job will be performed in the US, the successful candidate will be offered a competitive base salary and may be eligible for an annual bonus or commissions depending on the role. The base salary offered may vary depending on multiple factors, including but not limited to location, job-related knowledge, skills, and experience. Mastercard benefits for full time (and certain part time) employees generally include: insurance (including medical, prescription drug, dental, vision, disability, life insurance); flexible spending account and health savings account; paid leaves (including 16 weeks of new parent leave and up to 20 days of bereavement leave); 80 hours of Paid Sick and Safe Time, 25 days of vacation time and 5 personal days, pro-rated based on date of hire; 10 annual paid U.S. observed holidays; 401k with a best-in-class company match; deferred compensation for eligible roles; fitness reimbursement or on-site fitness facilities; eligibility for tuition reimbursement; and many more. Mastercard benefits for interns generally include: 56 hours of Paid Sick and Safe Time; jury duty leave; and on-site fitness facilities in some locations. THIS POSTING RELECTS ONE OR MORE CURRENT VACANCIES ON OUR TEAM, AND MASTERCARD INTENDS TO FILL THIS POSITION BY 01/18/2027. If the fill date has passed, Mastercard intends to fill this position as soon as possible.

Pay Ranges

New York City, New York: $131,000 - $216,000 USD