Mastercard India | Manager, Operational Risk & Controls - Europe

About the role and responsibilities

• The Manager, Operational Risk & Controls– Europe strengthens Mastercard Europe’s (MCE) risk posture by providing independent 2LoD oversight and challenge across high operational risk processes spanning both technology and non-technology domains. The role drives consistent application of the ORC framework (risk identification & assessment, control identification & evaluation, and ongoing management & monitoring), and supports MCE’s regulatory obligations (i.e. SIPS, PISA, CROE).
• Regional coverage: Mastercard Europe S.A. (MCE)
• Risk domains: Operational (incl. tech, process, people), legal & regulatory, third-party/outsourcing interfaces, and other topics relevant to European supervision.
• Regulatory context: Role contributes to ongoing readiness against regulatory expectations to comply with SIPS, PISA and CROE requirements, supporting alignment with supervisory themes (e.g., cyber/operational resilience expectations).
• Key relationships: ORC (Operational Risk and Controls) Global Function, 1LoD business and technology owners; 1LoD and 2LoD Tech Risk and Corporate Security; TPRM; Finance/Controllership; Regulatory Affairs; Internal Audit; MCE risk governance committees (TRC/BRCC/Board Risk Committee).
• Framework execution & oversight
• Champion application of the ORC Framework’s three pillars (Operational Risk Identification & Assessment; Controls Identification & Evaluation; Risk & Controls Management and Monitoring) across Europe; provide independent oversight, challenge, and guidance to 1LoD.
• Facilitate/oversee RCSAs (Risk and Control Self Assessments) and risk & control register for high operational risk processes (HORPs); ensure risks, controls, issues, risk events and treatments are captured and maintained to ORC standards.
• Review control designs, effectiveness assessment and control testing results; escalate significant control gaps and delays, and track remediation through closure.
• Support the maintenance of a Europe tech and non-tech control framework including control testing, in partnership with Group ORC and first line teams, including tech risk management and Corporate Security functions, that meet EU regulatory expectations
• Technology & non-technology coverage
• Provide 2LoD oversight across technology risk and control domains (e.g., change management, availability, security, access, data) and nontech operational risks (e.g., process, people, financial operations), ensuring consistent control expectations across domains.
• Regulatory enablement & external expectations
• Produce ORC content to European Risk Governance packs (TRC/BRCC/ Board)
• Provide support as needed in regulator interactions on topics related to Operational Risk and Controls.
• Support MCE’s efforts to address CROE-related remediation actions by assessing whether security and technology control gaps are adequately identified, prioritized, and remediated in line with supervisory expectations.
• Risk events, issues & insights
• Review high/very high rated risk events for accurate rating, high-quality root cause analysis, and adequacy of remediation.
• Produce clear Management Reporting for governance forums; identify trends and emerging risks to inform priorities and controls evolution.
• Monitor issue/treatment plan milestones and challenge closure evidence for sufficiency and durability.
• Ways of working & tooling
• Oversee completeness of operational risk data (e.g., OpenPages entries, risk registers, control assessments, remediation evidence).
• Ensure documentation meets regulatory, audit, and Europe governance expectations — including CROE aligned evidence standards.

Experience and qualifications

• Experience: 6-8 years in operational risk, internal controls, or assurance in financial services/payments; proven work across both technology and business/non tech processes.
• Risk Management practices and frameworks: Strong working knowledge of ORC/ERM policy constructs (RCSA, risk & control registers, control evaluation & testing, issues/incidents/loss events, risk appetite).
• Regulatory familiarity: Practical understanding of EU regulator expectations with ability to translate requirements into control objectives and testing criteria.
• Skills: Analytical judgment; ability to challenge constructively; crisp writing for senior audiences; stakeholder management in a matrix.
• Tools: Experience with risk GRC-applications (e.g., OpenPages, Archer)
• Education/Certifications: Bachelor’s degree required; relevant certifications (e.g., CRISC, CISA, CIA) welcome.

Mastercard

Mastercard is a global payments technology company that runs one of the world's largest card payment networks, connecting consumers, merchants, banks and governments in more than 200 countries and territories. It does not issue cards or lend money itself: it provides the network, processing, security and data services that let banks and other partners offer credit, debit, prepaid and digital payment products. Its work also covers fraud prevention and cybersecurity, digital identity, open banking, and data-led advisory services for businesses and governments.

Mastercard has worked in India for more than four decades. It opened its first India technology hub in Pune in 2014, and Pune is now its largest workforce in a single city anywhere in the world; the company also has offices in Gurugram, Mumbai, Hyderabad, Bengaluru and Vadodara. Teams in India work on software, data and cybersecurity, and also in finance, franchise and network services, product management and the Advisors & Consulting Services practice, which gives clients strategy, analytics and marketing advice. Finance, revenue assurance, consulting and analytics roles here can suit CA, CFA, CMA, MBA (Finance) and commerce profiles.

• Industry: Payments technology — global card payment network, payment security and data services
• Headquarters: Purchase, New York, USA
• In India: Offices in Pune, Gurugram, Mumbai, Hyderabad, Bengaluru and Vadodara