Z

Zepz

Global digital cross-border payments platform

Global Outsourcing Services Manager

Regulatory Compliance & EthicsConfirmed live in the last 24 hours
Full-timeBelgiumNo salary listed

About the Job

Requirements

  • At least 10 years of experience in outsourcing governance, third-party risk, service management, or operational risk within financial services, including leadership of a Group-wide function.
  • Strong knowledge of the EBA Outsourcing Guidelines and a sound understanding of applicable DORA and operational resilience requirements sufficient to work effectively with TPRM, Risk, and Compliance.
  • A proven track record of designing and implementing Group-wide outsourcing frameworks, registers, and governance forums across multiple jurisdictions, and of engaging with supervisors and auditors.
  • Practical experience with service catalogues, intra-group or third-party service agreements, SLAs, KPIs, and KRIs, and with mapping services to systems, third parties, and subcontractors.
  • Experience in a cross-border payment or e-money institution, fintech, or bank.
  • A degree in law, finance, business and economics, risk management, or a related field.
  • Strong stakeholder management, influencing, and negotiation skills, with the ability to explain complex topics in plain business language to executive and Board audiences across countries, entities, and functions.
  • Strong analytical and problem-solving skills, with close attention to evidence and clear ownership.
  • Fluency in English.
  • A genuine curiosity about AI and how it can be applied in the role, including accelerating analysis and insight generation and improving process and communication design and delivery.
  • Practical professional experience using AI tools to connect information, draft content, build frameworks, or create insights from data.
  • Strong AI literacy, including understanding AI assistants' capabilities and limitations, effective prompting, and critically evaluating AI-generated output.
  • Awareness of ethical considerations and responsible use of AI in the workplace, particularly regarding sensitive data, customer experience, and compliance.

Responsibilities

  • Own the Group outsourcing framework, methodologies, and standards; maintain the outsourcing sections of the single Group Third Party and Outsourcing Risk Policy and Procedure, with TPRM maintaining the third-party and DORA sections; propose updates for review by Enterprise Risk Management and approval by the competent bodies.
  • Keep the framework aligned with the EBA Outsourcing Guidelines and applicable DORA requirements, incorporating input from Compliance on regulatory developments and from TPRM, as well as lessons learned from disruptions and provider failures.
  • Define minimum contractual requirements for intra-group and third-party arrangements, including information-sharing, audit, sub-outsourcing, and termination rights, subject to review by Legal and Compliance; TPRM remains responsible for DORA-specific third-party requirements.
  • Define Group standards for the outsourcing lifecycle from identification to exit, including reassessment frequencies, triggers, and information-sharing timelines; coordinate application with Risk Management and TPRM and escalate material gaps or exceptions.
  • Coordinate Group assessments, approvals, and governance reviews, including classification of critical or important functions and material arrangements.
  • Maintain the mapping of business services to third parties and a consolidated view of the sub-outsourcing chain, using TPRM's list of subcontractors supporting critical information systems; identify and report concentration risk and cross-entity dependencies on common providers, drawing on TPRM ICT concentration assessments for second-line assessment.
  • Set Group standards for Outsourcing Registers maintained by Local Outsourcing Managers, supply Group data on intra-group arrangements, and ensure consistency with the DORA Register of Information maintained by TPRM so each entity can obtain its own extract without undue delay.
  • Set Group exit-planning standards and verify that arrangements supporting critical or important functions have documented, periodically tested exit strategies, using TPRM exit strategies for ICT third-party providers; coordinate Group support with TPRM for entity-level business continuity and disaster recovery testing.
  • Own the Group service catalogue, including descriptions, Service Owners, service levels, KPIs, locations, and dependencies for each service; build it progressively from critical and core services and expand coverage and automation over time.
  • Agree with each local entity the services it receives and maintain the catalogue based on change requests from the Group or local entities, including regulatory requirements.
  • Reflect services, service levels, and responsibilities in intra-group agreements and contractual appendices; implement changes through formal change control, agreement with the entities concerned, and approval by each entity's management body.
  • Define SLAs, KPIs, and KRIs with Group Function Owners, covering service timeliness, quality, and productivity, and ensure measures are supported by reliable data for which Group Function Owners remain accountable.
  • Monitor service performance, identify breaches, trends, and recurring weaknesses, and use performance data, incidents, complaints, and local entity feedback to drive corrective actions and sustainable improvements with Group Function Owners through regular service reviews.
  • Act as the Group escalation point for service challenges and unresolved incidents raised by local entities, coordinating with Incident Management; respond within agreed timelines, maintain a log of material issues, actions, and decisions, and escalate unresolved challenges to ERCC while informing the ILOC of the entity concerned.
  • Provide each local entity with the Group Policy and Procedure and subsequent changes, with a summary of the impact, to support explicit local adoption.
  • Give local management bodies advance notice of planned changes to the framework, Group services, or centrally monitored providers, including a summary of risk analysis and impacts on service levels.
  • Provide each entity with evidence needed for its own decisions, including annual in-control statements, service risk and performance summaries, audit report summaries, pre-outsourcing assessments, sub-outsourcing chain information, and Group exit plans, held in the central repository.
  • Set global functional direction for outsourcing governance and service management, challenge material deviations from Group standards, require appropriate remediation, and escalate unresolved Group- or entity-level issues to the relevant governance body.
  • Report to ERCC on the outsourcing population, critical or important functions, critical ICT third parties, high-risk providers, concentration and sub-outsourcing dependencies, service performance, incidents, audit and supervisory findings, exit readiness, and granted risk acceptances; provide each ILOC with Group input and service-level reporting at the required frequency.
  • Submit critical or important function classifications, risk assessments, policy exceptions, and risk-acceptance requests for second-line challenge before decisions; share ERCC and ILOC reporting with Risk and Compliance in advance; report SLA breaches, incidents, and KRI exceedances into the operational risk framework; and apply the conflicts-of-interest process to intra-group arrangements and the role itself.
  • Support Group-level supervisory inspections, audits, and information requests, and track Group-owned remediation actions arising from supervisory findings through closure.
  • Provide global functional leadership to Local Outsourcing Managers by setting role standards, providing induction and ongoing guidance, contributing to objectives, monitoring local application of the framework, and promoting consistent practice across entities and jurisdictions.

Desired Qualifications

  • Experience in a cross-border payment or e-money institution, fintech, or bank; familiarity with payout-partner networks is an advantage.
  • A relevant professional certification, such as CTPRP, CRISC, ITIL 4, or an operational risk qualification, is an advantage.
  • French language skills are an advantage.
  • Prior experience using Claude (Anthropic) is a nice-to-have, but not essential.

About the Company

Zepz

Global digital cross-border payments platform

Zepz powers WorldRemit and Sendwave, two brands that move money across borders by delivering international transfers online rather than through legacy, cash-based systems. Senders use a cashless online service, while recipients choose delivery options such as bank deposit, cash pickup, mobile airtime top-up, or mobile money. The company operates in 50–130 sending countries across thousands of transfer corridors with a remote-first team of 800+ people. Its goal is to make international digital payments fairer, faster, and more flexible for both senders and receivers.

Company size
501-1,000
Company stage
Not listed
Total funding
Not listed
Headquarters
London, United Kingdom
Founded
2021

Recently Posted Jobs

Explore more opportunities at Zepz

See more jobs