Compliance and Risk Manager

Zact•Sunnyvale, CA

About The Position

Zact is seeking a hands-on Compliance and Risk Manager to operate key parts of its compliance program across audits, privacy, financial-crime oversight, monitoring, and risk management. The role coordinates Zact’s SOC 1, SOC 2, and PCI DSS audits; manages operational compliance with GDPR and other applicable privacy laws; and oversees Zact’s responsibilities related to BSA, AML, and OFAC. Because Zact distributes its platform through financial institutions, the financial-crime component focuses on monitoring and documenting reseller bank partners’ compliance activities, confirming that assigned responsibilities are performed, and supporting audits, examinations, and due diligence. The role does not serve as a bank’s BSA Officer or perform the bank’s core transaction-monitoring function. It ensures that Zact maintains appropriate oversight, documentation, escalation, and evidence regarding responsibilities performed by its financial institution partners. The manager reports to the Chief Compliance Officer and works closely with Security, Legal, Operations, Engineering, Finance, external auditors and assessors, and bank partners. The role also maintains compliance policies and documentation, coordinates risk assessments and testing, tracks findings through remediation, responds to due diligence requests, and helps improve and automate compliance processes as Zact scales.

Requirements

Bachelor’s degree or equivalent experience that strongly demonstrates the competency.
At least 5 years of experience in compliance, risk management, audit, information security compliance, or a related field.
Experience working in banking, fintech, payments, or another regulated financial-services environment.
Experience coordinating SOC 1, SOC 2, PCI DSS, or comparable compliance assessments and audits.
Hands-on experience managing or supporting compliance with GDPR and/or U.S. privacy laws.
Hands-on experience with BSA/AML, OFAC, or financial-crime compliance in a banking, fintech, payments, or financial-services environment.
Experience overseeing responsibilities performed by financial institutions, regulated partners, or other third parties.
Experience managing audit evidence, control testing, findings, exceptions, and remediation activities.
Experience conducting or supporting compliance risk assessments, monitoring, or testing.
Ability to work directly with auditors, assessors, financial institutions, and internal control owners.
Strong organizational skills and ability to manage multiple compliance initiatives and deadlines simultaneously.
Strong written communication and documentation skills.
Ability to translate regulatory and compliance requirements into practical operational processes.
Comfort working in a fast-moving environment and taking hands-on ownership of execution.

Nice To Haves

Experience working with bank partners where compliance responsibilities are shared between a technology provider and the financial institution.
Familiarity with SOC 1, SOC 2, PCI DSS, GDPR, CCPA/CPRA, BSA/AML, OFAC, and related regulatory frameworks.
Experience with compliance management, GRC, or audit-management platforms.
Relevant certifications such as CAMS, CIPP, CRCM, CISA, or similar credentials.

Responsibilities

Coordinate annual SOC 1 and SOC 2 audits, including planning, evidence collection, auditor requests, control-owner coordination, and remediation.
Coordinate PCI DSS assessments and related compliance activities.
Maintain audit calendars, evidence repositories, control documentation, and supporting records.
Work with control owners to ensure required controls are performed and documented throughout the year.
Track audit findings, exceptions, and remediation items through completion, and serve as a primary operational contact for external auditors and assessors.
Maintain continuous audit readiness.
Manage operational compliance with GDPR and other applicable privacy laws and regulations.
Maintain and coordinate privacy policies, procedures, data inventories, retention requirements, and supporting documentation.
Work with Legal, Security, Engineering, and business teams to incorporate privacy requirements into products and operations.
Coordinate responses to privacy-related customer and bank due diligence requests, and support privacy assessments, audits, and remediation.
Monitor changes in applicable privacy requirements and coordinate updates to controls, policies, and procedures.
Manage Zact’s oversight program for BSA, AML, and OFAC activities performed by reseller bank partners.
Confirm that applicable bank partners maintain appropriate BSA/AML and OFAC programs and perform assigned responsibilities.
Collect and review certifications, policies, audit reports, testing results, and other evidence from bank partners.
Maintain documentation of ongoing oversight of reseller bank compliance activities.
Identify gaps, exceptions, or missing evidence and coordinate follow-up with bank partners and internal stakeholders.
Support audits, examinations, and due diligence reviews involving Zact’s BSA/AML and OFAC oversight responsibilities.
Coordinate with the Chief Compliance Officer on escalation of material compliance issues.
Conduct periodic compliance risk assessments and develop and maintain a risk-based compliance monitoring and testing program.
Perform or coordinate periodic testing to confirm compliance controls operate as intended.
Identify, document, escalate, and track compliance issues through remediation and closure.
Monitor changes in applicable laws, regulations, and compliance frameworks and coordinate updates to policies, controls, and procedures.
Maintain records of open findings, remediation plans, owners, and target completion dates.
Maintain compliance policies, procedures, control documentation, and supporting evidence.
Coordinate regulatory, customer, and third-party compliance audits and assessments.
Track compliance obligations, testing schedules, findings, remediation plans, and deadlines.
Coordinate bank and prospective customer compliance due diligence requests.
Prepare compliance reporting for the Chief Compliance Officer, including open findings, remediation status, upcoming audits, and material compliance risks.
Work across the organization to ensure compliance requirements are understood and implemented.
Identify opportunities to improve and automate compliance processes as the company scales.