About the role
Read this first
This role is not for most compliance people. It is narrow, exacting and unforgiving of vague work. If the "you will not enjoy this" section describes you, don't apply. We'd rather you didn't.
The job
You find risk, measure it and call it. You do not fix it. Every finding you write answers three things: what is broken, how bad it is, and what evidence proves it. You don't soften the rating and you don't propose the remedy. The business owns the fix. You own the truth about the risk.
What you will do
- Test our BSA/AML, KYC, OFAC and transaction monitoring controls end to end, independently of the teams that run them
- Rate every finding (high / medium / low) with evidence that holds up in front of a regulator
- Pull and analyze data yourself; you don't wait for someone to send you a report
- Challenge thresholds, alert logic and sampling assumptions with numbers, not opinions
- Track open issues until owners close them, and escalate when they don't
- Prepare us for regulator exams and audits, and be the person in the room who already knows the weak spots
What you need (non-negotiable)
- 4+ years in BSA/AML, FinCrime, internal audit or regulatory compliance
- Experience at a top-tier audit/advisory firm, in-house compliance, or both. Both is ideal.
- You have written findings that a regulator, auditor or board actually read
- You can say "this is high risk" to a senior leader and point to the regulation which proves it.
- Deep working knowledge of the BSA, USA PATRIOT Act, OFAC and FinCEN expectations
Nice to have
- Law degree (JD) or bar admission
- Degree in engineering, mathematics, statistics or another STEM field
- SQL: you can query transaction data yourself
- Python or R for analysis, sampling or testing alert logic
- Statistics: sampling design, hypothesis testing, threshold and model validation
CAMS, CRCM, CIA, CISA, CPA or CFE
- Exposure to AI or model risk (SR 11-7, NIST AI RMF)
You will not enjoy this role if
- You prefer building solutions to finding problems
- You need someone else to pull the data for you
- You round risk ratings down to keep people comfortable
- You are uncomfortable being the person no one wants in the meeting
- You uniform to the norm.