Vendor Risk Manager

About the Role

Tabby is seeking a Vendor Risk Manager to oversee the entire third-party risk program. This full-time position is based in Riyadh and requires 2-5 years of relevant experience. The role is critical for managing vendor relationships that support core BNPL operations, including KYC providers, credit bureaus, payment processors, and collections agencies.

Role Overview

The Vendor Risk Manager will be responsible for ensuring the stability and compliance of Tabby's vendor chain, from initial due diligence through to vendor offboarding. This involves providing leadership with clear insights into potential vendor risks and implementing strategies to prevent vendor failures from impacting customers or leading to regulatory scrutiny.

Key Responsibilities

• Conduct due diligence on new vendors, including financial health checks, SOC 2 / ISO 27001 reviews, breach history, and subprocessor mapping, before contract signing.
• Assign clear risk ratings to prospective vendors (KYC, identity verification, fraud detection, credit bureau, payment processing, card issuing, banking, collections) with specific conditions.
• Collaborate with Legal and Procurement to secure essential contractual terms such as audit rights, breach notification windows, data localization commitments, exit assistance clauses, and SLAs with penalties.
• Manage vendor risk assessments across the active third-party portfolio, prioritizing critical and high-risk vendors for annual deep-dive reviews.
• Implement and manage tiered monitoring cadences (quarterly for critical vendors, annually for others) to track control drift, subprocessor changes, and adverse media.
• Maintain the concentration risk and critical-vendor register, explaining single points of failure and their contingency plans.
• Work with Product teams on new vendor integrations, participating in the evaluation of new checkout partners or fraud model vendors from the outset.
• Prepare vendor risk reports for the Risk Committee and Board, translating control gaps and incident trends into actionable decisions.
• Oversee the offboarding process for exited vendors, ensuring data deletion, access revocation, and transition continuity for customer-facing services.
• Confirm that regulatory and contractual exit obligations are met and documented, particularly for critical or important vendors.

Qualifications and Experience

• 2-5 years of experience in vendor risk management or a related field.
• Demonstrated ability to manage third-party risk programs from end-to-end.
• Understanding of due diligence processes, risk assessment methodologies, and ongoing monitoring practices.
• Familiarity with regulatory and contractual requirements related to vendor management.

Work Environment

This is a full-time position based in Riyadh, Saudi Arabia, within a dynamic fintech environment. The role involves cross-functional collaboration with legal, procurement, and product teams.

Application Process

Candidates interested in this Vendor Risk Manager position are encouraged to apply.