Tech Risk & Controls Lead

At Snappi, we're building a neobank from the ground up. Our mission is to empower financial freedom through technology, offering innovative and transparent digital banking solutions.  

Join us in reshaping the financial landscape! 

As Tech Risk & Controls Lead, you will help embed risk, controls and regulatory compliance into Snappi's technology environment, ensuring evidence is generated through automation, live data and AI-enabled workflows rather than manual reporting. Partnering with Engineering, Security, Data and Risk teams, you will drive a scalable, technology-first control framework that enables effective governance, regulatory compliance and audit readiness in a cloud-native banking environment.

• →Own the Technology risk and control register, including risks, controls, owners, testing results and remediation actions across ICT, Data, ML Ops, Predictive AI, PMO and third-party delivered technology services. 

• →Translate approved ICT risk and security policies into concrete controls in Azure, Azure DevOps/GitHub, Jira and Microsoft 365, ensuring each control has clear ownership and an identifiable evidence source. 

• →Lead ICT third-party risk oversight activities, including provider classification, due diligence coordination, SLA and KRI monitoring, exit planning and maintenance of DORA Register of Information requirements. 

• →Produce and coordinate Technology's contribution to recurring risk, governance and regulatory reporting, including third-party risk reporting, RCSAs, ICT risk indicators, incident reporting and committee materials. 

• →Track Technology's actions in the ECB AI-enabled cyber threats plan, audit findings, regulatory actions and supervisory requests through to closure, ensuring appropriate evidence is captured and maintained.

• →Manage the control aspects of Technology's AI risk framework, including AI use case inventory, data classification and monitoring of model or agent changes. 

• →Serve as the primary point of contact for Audit, Operational Risk, Compliance and CISO requests into Technology, ensuring they are routed to the appropriate owners and tracked to completion. 

• →Partner with Technology leaders to strengthen risk ownership and control accountability, providing coordination, visibility and evidence while keeping ownership with the business and engineering teams. 

This role will leverage automation, data and AI-enabled workflows to strengthen control monitoring, regulatory reporting and technology governance. 

You will contribute to: 

• Automating control evidence collection from platforms such as Azure Policy, Microsoft Defender, Entra ID, Purview, Azure DevOps, GitHub and Jira. 

• Generating risk, third-party and governance reporting from live data sources rather than manual quarterly exercises. 

• Leveraging AI-enabled assessments to support vendor due diligence, control gap analysis and regulatory reviews. 

• Mapping new regulatory and policy requirements to existing controls to identify gaps and overlaps more efficiently. 

• Working with Engineering teams to embed controls within CI/CD pipelines and technology delivery processes, ensuring governance, segregation-of-duties and security requirements are evidenced by design. 

Required 

• 5+ years of experience in Cloud Engineering, Platform Engineering, SRE, DevSecOps, Technology Risk or Technology Audit within a regulated environment, ideally banking, fintech or payments. 
• Working knowledge of DORA, ICT risk management frameworks and third-party risk management principles. 
• Hands-on experience with Azure, Microsoft 365 security and compliance tooling, and the ability to work with scripts, APIs or automation tools. 
• Practical experience using AI tools, agents or LLM-based workflows to improve operational processes. 
• Strong written and verbal communication skills in both English and Greek. 

Nice to Have 

• CISA, CRISC or similar professional certifications. 
• Experience with GRC platforms, risk data models or workflow-management tools. 
• Experience in vendor management, outsourcing oversight or service-level monitoring.