Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowFirst seen 3 days ago

Vendor Risk Manager

Tabby42 open roles

Where
Riyadh, Saudi Arabia
Work mode
On site
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowVendor Risk ManagerTabby · Riyadh, Saudi Arabia

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Tabby's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.1% of postings close within 7 days. Measured by our own scanner across the market. Tabby postings stay open a median of 2 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.1%7 days
  4. 19.1%14 days
  5. 35.6%30 days
  6. 52.7%60 days
This job: first seen 3 days ago

Tabby median: 2 days open

The posting

BNPL businesses don't run on a single core system — they run on a chain of vendors: KYC providers doing identity checks in milliseconds, bureau data feeding underwriting decisions, processors moving money at checkout, and collections agencies chasing missed payments on our behalf. When any link in that chain fails, it isn't an internal inconvenience — it's a customer who can't check out, a credit decision made on bad data, or a regulator asking why a critical service went down with no warning. As Vendor Risk Manager, you will own our third-party risk program end to end, from the first due diligence questionnaire to the day a vendor is offboarded. You will be the person who can tell leadership, in plain terms, which vendors carry the most risk and why, and you will make sure vendor failures never become customer failures.

Key Responsibilities

Due Diligence & Onboarding

  • Run due diligence on new vendors before contracts are signed, including financial health checks, SOC 2 / ISO 27001 review, breach history, and subprocessor mapping.
  • Issue a clear risk rating for every prospective vendor, with conditions attached rather than a simple pass or fail, covering KYC, identity verification, fraud detection, credit bureau, payment processing, card issuing, banking, and collections partners.
  • Sit inside the contracting process with Legal and Procurement to secure the terms that matter: audit rights, breach notification windows, data localization commitments, exit assistance clauses, and SLAs tied to real penalties.

Risk Assessment & Ongoing Monitoring

  • Own vendor risk assessments across our active third-party portfolio, prioritizing critical and high-risk vendors for annual deep-dive reviews.
  • Build and run tiered monitoring cadences — quarterly for critical vendors such as KYC, payment processing, and banking partners, annual for the rest — tracking control drift, subprocessor changes, and adverse media.
  • Maintain the concentration risk and critical-vendor register, and be ready to explain single points of failure, such as one bureau covering the majority of underwriting volume, and what the contingency plan actually is.

Cross-Functional Partnership

  • Work with Product before new vendor integrations go live — you're in the room when a new checkout partner or fraud model vendor is being evaluated, not brought in after the contract is signed. • Prepare vendor risk reporting for the Risk Committee and Board, translating control gaps and incident trends into decisions leadership can act on.

Offboarding & Exit Management

  • Manage the offboarding process for exited vendors, confirming data deletion, access revocation, and transition continuity for anything customer-facing.
  • Ensure regulatory and contractual exit obligations are met and documented, particularly for vendors classified as critical or important.

Skills, Knowledge & Expertise

  • 3–4 years in third-party risk management, vendor risk, or operational risk, ideally at a payments company, lender, bank, or fintech where vendor failure has direct customer or regulatory consequences.
  • Working knowledge of NIST CSF, ISO 27001, SOC 2, and standardized assessment tools like SIG or CAIQ — you know how to read a SOC 2 report and spot what's missing, not just file it away.
  • Familiarity with the regulatory landscape vendors sit inside: consumer credit rules, data privacy obligations (GDPR/CCPA depending on footprint), PCI-DSS for anything touching card data, and outsourcing/operational resilience expectations for critical third parties.
  • Comfort negotiating directly with vendors — you've pushed back on a processor's standard MSA, gotten a fraud vendor to commit to a real SLA, and know when “our legal team will follow up” means the deal needs to walk.
  • Ability to translate risk findings for people who don't think in risk terms, including explaining to a commercial lead why a cheaper KYC vendor isn't worth the onboarding delay it will cause six months later.
  • Strong analytical skills with the ability to interpret vendor performance and control data to support operational decisions.
  • Excellent communication and interpersonal skills, with the ability to interact effectively across all levels of the organization.
  • Full professional proficiency in English required; Arabic is a plus.

Nice to have:

  • Direct BNPL or consumer credit experience — you've worked with bureau data, alternative credit scoring
  • vendors, or collections agencies specifically.
  • Hands-on experience with a GRC platform such as OneTrust, ProcessUnity, or Archer for assessment
  • workflows and vendor inventory.
  • CTPRP, CRISC, CISA, or CISM certification.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Tabby's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Tabby's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Tabby's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.