Compliance and Risk Manager

Zact Inc.•Sunnyvale, CA

About The Position

Zact is seeking a hands-on Compliance & Risk Manager to own day-to-day operation of key elements of its compliance program across audit, privacy, and financial-crime oversight. The role coordinates Zact’s SOC and PCI audits, manages compliance with GDPR and other applicable privacy laws, supports compliance monitoring and testing, and oversees Zact’s responsibilities related to BSA, AML, and OFAC. Because Zact distributes its platform through financial institutions, the BSA/AML/OFAC work primarily involves monitoring and documenting reseller bank partners’ compliance activities, confirming that assigned responsibilities are performed, and supporting related audits, examinations, and due diligence reviews. The role does not serve as a bank’s BSA Officer or perform the bank’s core transaction-monitoring function. Instead, it ensures appropriate oversight, documentation, escalation, and evidence regarding compliance responsibilities performed by financial institution partners. The Compliance & Risk Manager reports to the Chief Compliance Officer and works closely with Security, Legal, Operations, Engineering, Finance, and bank partners. The role also maintains compliance policies, procedures, control documentation, evidence, schedules, findings, remediation plans, and reporting, while helping improve and automate compliance processes as the company scales.

Requirements

Bachelor’s degree or equivalent experience strongly demonstrating the competency.
At least 5 years of experience in compliance, risk management, audit, information security compliance, or a related field.
Experience in banking, fintech, payments, or another regulated financial-services environment.
Experience coordinating SOC 1, SOC 2, PCI DSS, or comparable compliance assessments and audits.
Hands-on experience managing or supporting compliance with GDPR and/or U.S. privacy laws.
Hands-on experience with BSA/AML, OFAC, or financial-crime compliance in a banking, fintech, payments, or financial-services environment.
Experience overseeing responsibilities performed by financial institutions, regulated partners, or other third parties.
Experience managing audit evidence, control testing, findings, exceptions, and remediation activities.
Experience conducting or supporting compliance risk assessments, monitoring, or testing.
Ability to work directly with auditors, assessors, financial institutions, and internal control owners.
Strong organizational skills and ability to manage multiple compliance initiatives and deadlines simultaneously.
Strong written communication and documentation skills.
Ability to translate regulatory and compliance requirements into practical operational processes.
Comfort working in a fast-moving environment and taking hands-on ownership of execution.

Nice To Haves

Experience working with bank partners where compliance responsibilities are shared between a technology provider and the financial institution.
Familiarity with SOC 1, SOC 2, PCI DSS, GDPR, CCPA/CPRA, BSA/AML, OFAC, and related regulatory frameworks.
Experience with compliance management, GRC, or audit-management platforms.
Relevant certifications such as CAMS, CIPP, CRCM, CISA, or similar credentials.

Responsibilities

Coordinate annual SOC 1 and SOC 2 audits, including planning, evidence collection, auditor requests, control-owner coordination, and remediation.
Coordinate PCI DSS assessments and related compliance activities.
Maintain audit calendars, evidence repositories, control documentation, and supporting records.
Work with internal control owners to ensure controls are performed and documented throughout the year.
Track audit findings, exceptions, and remediation items through completion.
Serve as a primary operational contact for external auditors and assessors and help maintain continuous audit readiness.
Manage operational compliance with GDPR and other applicable privacy laws and regulations.
Maintain and coordinate privacy policies, procedures, data inventories, retention requirements, and supporting documentation.
Work with Legal, Security, Engineering, and business teams to incorporate privacy requirements into products and operations.
Coordinate responses to privacy-related customer and bank due diligence requests; support privacy assessments, audits, and remediation.
Monitor changes in privacy requirements and coordinate updates to controls, policies, and procedures.
Manage Zact’s oversight program for BSA, AML, and OFAC activities performed by reseller bank partners.
Confirm bank partners maintain appropriate BSA/AML and OFAC programs and perform assigned responsibilities.
Collect and review bank partner certifications, policies, audit reports, testing results, and other evidence.
Maintain documentation of ongoing oversight of reseller bank compliance activities; identify gaps or missing evidence and coordinate follow-up.
Support audits, examinations, and due diligence reviews involving Zact’s BSA/AML and OFAC oversight responsibilities.
Coordinate with the Chief Compliance Officer on escalation of material compliance issues.
Conduct periodic compliance risk assessments and develop and maintain a risk-based monitoring and testing program.
Perform or coordinate periodic testing to confirm compliance controls operate as intended.
Identify, document, escalate, and track compliance issues through remediation and closure.
Monitor changes in applicable laws, regulations, and compliance frameworks and coordinate updates to policies, controls, and procedures.
Maintain records of open findings, remediation plans, owners, and target completion dates.
Maintain compliance policies, procedures, control documentation, and supporting evidence; coordinate regulatory, customer, and third-party audits and assessments.
Track compliance obligations, testing schedules, findings, remediation plans, and deadlines.
Coordinate bank and prospective customer compliance due diligence requests.
Prepare compliance reporting for the Chief Compliance Officer, including open findings, remediation status, upcoming audits, and material compliance risks.
Work across the organization to ensure compliance requirements are understood and implemented, and identify opportunities to improve and automate compliance processes.