Tabby

Vendor Risk Manager

Tanger-Tétouan-Al Hoceïma

CDI / Temps pleinSur site3–5 ansAnglais, ArabeAudit / Contrôle de gestionServices financiers

L’essentiel du poste

Résumé par Postule AI

Vendor Risk Manager role at Tabby, a BNPL fintech company, responsible for managing third-party risk across the entire vendor lifecycle. You will conduct due diligence, assess ongoing risks, negotiate contracts, and ensure vendor failures do not impact customers. This role requires 3–4 years of vendor or operational risk experience in financial services, deep knowledge of security frameworks and regulatory requirements, and strong vendor negotiation skills.

Vos missions

  • Conduct due diligence on new vendors including financial health, SOC 2/ISO 27001 reviews, and breach history; issue risk ratings with conditions
  • Own vendor risk assessments and build tiered monitoring cadences—quarterly for critical vendors, annual for others—tracking control drift and adverse media
  • Negotiate with Legal and Procurement to secure critical contract terms including audit rights, breach notification windows, and SLAs with penalties
  • Partner with Product teams to evaluate new vendor integrations before go-live and prepare risk reporting for Risk Committee and Board
  • Manage vendor offboarding, confirming data deletion, access revocation, and regulatory/contractual exit obligations

Profil recherché

  • You have 3–4 years of vendor or operational risk experience in financial services or fintech
  • You are comfortable negotiating directly with vendors and pushing back on unfavorable contract terms
  • You can translate complex risk and control findings into clear, actionable insights for non-risk stakeholders
  • You have hands-on experience with security frameworks like SOC 2, ISO 27001, and regulatory requirements like GDPR/CCPA and PCI-DSS
  • You are fluent in English and ideally have Arabic language skills

Généré automatiquement à partir de l’offre. Postule AI peut se tromper : vérifiez auprès de l’employeur.

About the Role

As Vendor Risk Manager at Tabby, you will own the third-party risk program end to end, from initial due diligence through vendor offboarding. You will be responsible for identifying and communicating vendor risks to leadership and ensuring vendor failures never become customer failures in a BNPL environment where KYC providers, payment processors, credit bureaus, and collections agencies are critical to operations.

Key Responsibilities

Due Diligence & Onboarding
  • Conduct comprehensive due diligence on new vendors including financial health checks, SOC 2/ISO 27001 reviews, breach history, and subprocessor mapping
  • Issue clear risk ratings for prospective vendors covering KYC, identity verification, fraud detection, credit bureaus, payment processing, and collections partners
  • Collaborate with Legal and Procurement to secure critical contract terms including audit rights, breach notification windows, data localization commitments, and SLAs with real penalties
Risk Assessment & Ongoing Monitoring
  • Own vendor risk assessments across the active third-party portfolio with prioritized annual deep-dive reviews for critical and high-risk vendors
  • Build and execute tiered monitoring cadences—quarterly for critical vendors, annual for others—tracking control drift, subprocessor changes, and adverse media
  • Maintain concentration risk and critical-vendor registers, explaining single points of failure and contingency plans to leadership
Cross-Functional Partnership
  • Partner with Product teams before new vendor integrations go live to evaluate checkout partners and fraud model vendors
  • Prepare vendor risk reporting for the Risk Committee and Board, translating control gaps into actionable decisions
Offboarding & Exit Management
  • Manage vendor offboarding processes, confirming data deletion, access revocation, and transition continuity for customer-facing services
  • Ensure regulatory and contractual exit obligations are met and documented for critical and important vendors

Required Skills & Experience

  • 3–4 years in third-party risk management, vendor risk, or operational risk at a payments company, lender, bank, or fintech
  • Working knowledge of NIST CSF, ISO 27001, SOC 2, and standardized assessment tools like SIG or CAIQ
  • Familiarity with regulatory landscape including consumer credit rules, GDPR/CCPA, PCI-DSS, and operational resilience expectations
  • Proven ability to negotiate directly with vendors and push back on unfavorable terms
  • Strong analytical skills to interpret vendor performance and control data for operational decisions
  • Excellent communication skills to translate risk findings for non-risk stakeholders across all organizational levels
  • Full professional proficiency in English; Arabic is a plus

Nice to Have

  • Direct BNPL or consumer credit experience with bureau data, alternative credit scoring, or collections agencies
  • Hands-on experience with GRC platforms such as OneTrust, ProcessUnity, or Archer
  • CTPRP, CRISC, CISA, or CISM certification

Mise en forme par Postule ·

Signaler un problème