Outsourcing Business Owner

About the role

As Outsourcing Business Owner, you are the first line of defense for all outsourcing and critical ICT relationships within Client Impact. You own and manage the full lifecycle of outsourced services — from pre-contractual due diligence through active governance to annual compliance reviews — in accordance with EBA/GL/2019/02 guidelines, MaRisk (AT 9), and DORA. This is a high-ownership role that sits at the intersection of regulatory compliance, operational excellence, and client relationship management.

What you'll do

• Lead contract review and negotiation to ensure alignment with regulatory requirements and operational needs before signature.
• Conduct structured due diligence: gather all required documentation on providers' financial health, security posture, and compliance certifications.
• Perform risk assessments identifying operational, legal, and security threats associated with each outsourcing partner.
• Define and set up mandatory KPIs, thresholds, and monitoring mechanisms as a condition of onboarding.
• Monitor KPIs and SLAs on a regular basis to ensure outsourced services meet performance standards.
• Report on outsourcing performance to Central Outsourcing Management on a quarterly and annual basis.
• Incident reporting: formally report incidents, track action plans to closure, and ensure root cause analysis is performed and remediated.
• Lead comprehensive annual risk reviews of all outsourcing relationships, and trigger ad-hoc reviews in response to major incidents, provider structural changes, or regulatory updates.

What you'll need

• 3+ years of experience in outsourcing management, third-party risk, compliance, or a closely related operational role — ideally within a regulated financial institution or fintech.
• Solid working knowledge of EBA outsourcing guidelines, MaRisk AT 9, and/or DORA; hands-on experience applying these in practice.
• Strong project management skills: you can run multiple governance tracks in parallel without dropping the ball.
• Analytical mindset: comfortable with risk assessments, KPI analysis, and translating regulatory obligations into operational processes.
• Excellent written and verbal communication in English (German is a plus).
• High ownership mentality: you don't wait to be asked. You identify gaps, raise them, and fix them.
• Comfortable working across a 3-lines-of-defense model and collaborating with GRC, Legal, Compliance, and Internal Audit.

Nice to have

• Experience with investment or brokerage services, BaaS/IaaS platforms, or other white-label financial products.
• Familiarity with ICT risk management and critical third-party provider (CTPP) classification under DORA.
• Experience working in a scale-up or hypergrowth environment where processes are still being built.

What they offer

• 30 days annual leave, sports benefits, and up to 183 days remote abroad per year.
• One-month fully paid sabbatical after every 4 years at Upvest.
• Personal development budget with freedom to use as you choose.
• Hybrid or remote work across Europe from hubs in Berlin, London, or Tallinn.
• Competitive, above-market salary and employee equity program participation.