Risk Intelligence Lead

About the Role

Forward's Risk and Compliance Operations is scaling to support 45x merchant volume without 45x headcount. The only way that works is if the function gets smarter faster than it grows. That is what this role exists to build.

The Risk Intelligence Lead owns the analytical core of RCO. You will build the intelligence layer that powers decision-making across the function: dashboards that surface trends, patterns, and anomalies before they become incidents; AI-assisted workflows that compress review time and reduce manual effort; SQL infrastructure that turns raw operational data into forward-looking signals; and the automation that systematically eliminates the manual work that does not need to be manual.

What makes this role distinct is where the intelligence comes from. You do not study the operation from a distance - you sit in it. Reviewing alerts and cases, working through merchant applications, understanding the day-to-day rhythm of the work is what gives you the pattern recognition to build systems that actually work. The best analytical infrastructure is built by someone who has lived the friction, not just modeled it.

This is a build role at a company scaling fast. The person who does this well will shape what the RCO function looks like at 10x, 20x, 50x - and will grow directly with it.

Key Responsibilities

Own the Day-to-Day Merchant Lifecycle

• Manage the merchant application review queue: evaluate onboarding submissions for accuracy, completeness, and risk indicators - including multi-layered KYB verification (legal structure, beneficial ownership, UBO identification, PEP and sanctions screening) and Enhanced Due Diligence for high-risk merchant segments.
• Apply risk-based profiling: stratify incoming applications by geography, industry, transaction profile, and ownership structure - calibrating review depth to risk tier (standard, elevated, EDD) rather than applying uniform scrutiny to every application.
• Oversee bank account linking and verification, troubleshooting exceptions and monitoring for suspicious changes: account swaps pre- or post-large transaction clusters, mismatched ownership, high-risk bank patterns.
• Review and action transaction monitoring and fraud cases within defined SLA tiers: Tier 1 high-risk cases under 4 hours, Tier 2 medium-risk cases under 24 hours. Escalate where policy-level judgment is required.
• Handle bank returns, disputes, and chargeback escalations with timely resolution - operating within Visa VAMP and Mastercard ACMP thresholds, which now govern both fraud and chargeback disputes in a single consolidated ratio with consequences for exceeding them.
• Act as subject matter expert for onboarding and operational risk - training and guiding junior team members as the function scales, building playbooks that help others reach your level of judgment.

Identify Patterns and Act on Them

• Monitor onboarding, TM, and fraud queues not just case by case, but across the cohort: "why do merchants in this vertical have 3x the chargeback rate of others?" is as important as "what do I do with this one case?"
• Own the auto-adjudication boundary: define what should be handled without manual touch (low-risk, clean profile, within thresholds) versus what requires human review - and push that boundary forward systematically. Target: 70%+ of cases handled without manual touch, growing month-over-month.
• Perform root cause analysis on recurring issues and own the fix through to deployment. Not just "I found it" - "I fixed it."
• Partner with Engineering to translate operational patterns into Taktile rule changes, Metabase dashboards, Retool screen improvements, or CommsHub triggers.

Build the Intelligence Layer

• Own the SQL-based reporting and analytical infrastructure that powers RCO decision-making: activation trends, TM alert patterns, onboarding funnel drop-off, chargeback attribution, volume anomalies, and VAMP/ACMP ratio tracking against Visa and Mastercard program thresholds by partner and vertical.
• Design and operate AI-assisted review workflows: LLM-based case summarization (using Snowflake Cortex or equivalent) that distills merchant application context, KYC documents, and prior case history into a reviewable brief before a human touches the case. Build Taktile AI agents that handle multi-step investigative tasks - sanctions check, UBO verification, risk score retrieval, reviewer routing - as a single agentic workflow rather than a sequence of manual steps.
• Build and maintain the Metabase dashboards and operational views that give the RCO team real-time visibility: alert volume and SLA attainment by tier, auto-adjudication rate trending, false positive rate by rule, merchant health scorecards, and chargeback rate by partner and vertical.
• Translate raw warehouse data into forward-looking signals: surface where volume, risk, or friction is trending adverse before it becomes an incident. Anomaly detection that fires at the pattern level, not just the individual case level.
• Own model literacy for the team: interpret and act on fraud model outputs (risk scores, confidence signals, anomaly flags) from the Risk Data Scientist, and translate them into operational decisions and rule threshold adjustments in Taktile.

Drive Automation and Tooling

• Identify manual workflows that can be eliminated through Python scripting, automation, or AI tooling - and own delivery of those improvements through to deployment. Examples: hourly scripts that pull high-risk merchant alerts and route them; daily scripts that check metrics against thresholds and fire Slack notifications; webhook-triggered agentic workflows that kick off investigation steps the moment a flag fires.
• Maintain SOPs that reflect how the team actually operates - living playbooks, not static documentation. Every new process you build gets a runbook. Every runbook gets maintained.
• Spec, test, and validate operational tooling in partnership with Engineering; represent the operations perspective in product and roadmap discussions.
• Track and report automation rate as a first-class metric: how many cases are being handled without manual touch this month versus last month? That number should be going up.

Lead the Function

• Serve as the senior RCO voice in cross-functional discussions with Engineering, Product, GTM, and Support.
• Provide data-backed input on partner-level risk trends, onboarding friction, and fraud patterns to inform product roadmap prioritization.
• Design the Risk Intelligence function for scale: as headcount grows beneath this role, define the team structure, tooling stack, operational cadence, and SLA framework.
• Support the CRCO directly with ad-hoc analytical requests, board-level risk narratives, regulatory prep, and bank sponsor audit documentation.
• Own regulatory monitoring for the function: track changes to Visa VAMP thresholds, Mastercard ACMP updates, FinCEN guidance, and OCC BSA/AML examination procedures - and translate regulatory changes into operational implications before they become compliance gaps.

Required Qualifications

• 4-7 years in fraud analysis, risk operations, compliance operations, or fintech - with hands-on queue ownership (merchant onboarding, TM case review, dispute resolution), not just oversight.
• Deep knowledge of KYC/KYB: multi-layered business verification, UBO identification and beneficial ownership mapping, PEP and OFAC sanctions screening, EDD triggers, and perpetual ongoing monitoring (not a one-time event at onboarding).
• Strong working knowledge of AML/BSA: SAR filing obligations and thresholds, structuring and money laundering typologies, high-risk red flags, and OCC/FinCEN examination standards.
• Strong working knowledge of card payment processing: authorizations, settlements, Visa VAMP and Mastercard ACMP chargeback and fraud monitoring programs, dispute timelines, and acquirer liability frameworks.
• Strong working knowledge of ACH processing: return codes, NACHA guidelines, bank return resolution, and exception handling.
• SQL proficiency - comfortable pulling and interpreting operational data from a modern data warehouse, navigating complex schemas, and writing queries that surface cohort-level patterns. Snowflake experience preferred.
• Python scripting for operational automation: scheduling scripts, API integration, data manipulation, alert generation, and report distribution. This is operational automation, not ML modeling - scripts that eliminate manual steps.
• Demonstrated experience using AI tools (LLMs, agentic workflows, automation frameworks) to augment operational work: case summarization, triage acceleration, multi-step investigative workflows.
• Track record of driving process and tool improvements from identification through deployment.
• Strong written and verbal communication: produces clear case documentation and risk narratives, presents findings to cross-functional stakeholders.

Preferred Qualifications

• Experience with Metabase, Retool, Snowflake Cortex, or similar data and ops tooling.
• Familiarity with decisioning platforms (Taktile, Provenir, or similar) and the ability to configure rule changes without engineering support.
• Experience in a PFAC, ISO, or payment facilitator environment.
• Exposure to model governance, risk policy documentation, or bank sponsor audit preparation (SR 11-7 framework).
• Familiarity with ECOA fairness requirements: disparate impact analysis and the operational implication of risk rules that have unintended demographic effects.
• Experience building or maintaining agentic workflows for compliance or fraud investigation tasks.

What Success Looks Like

Operational Throughput

• Case review SLA attainment is 95%+ across all tiers. Nothing ages without a decision.
• Average case resolution time within tier: Tier 1 high-risk under 4 hours, Tier 2 medium-risk under 24 hours, Tier 3 standard under 7 days.
• Alert false positive rate: under 5% is acceptable; under 2% is excellent. Analyst time goes to real risk, not noise.
• Auto-adjudication rate at 70%+, growing month-over-month.
• Case escalation rate under 10%: high escalation rates signal miscalibrated rules or a model that needs tuning.

Intelligence and Visibility

• Every key operational workflow has dashboard coverage. No blind spots. Execs look at your dashboards daily.
• Anomalies surface before they escalate: the team detects emerging patterns at the cohort level, not because a merchant complained.
• VAMP and ACMP ratios are tracked in real time by partner and vertical - the team knows before a threshold is crossed, not after.
• Fraud model performance is monitored in partnership with the Risk Data Scientist: detection rate, precision, recall, and drift are tracked and acted on.

Automation and Scale

• Manual steps in core workflows decline quarter-over-quarter, driven by automation you own and delivered.
• AI tooling is embedded in at least two core workflows within 90 days, with measurable time savings tracked and reported.
• SOPs and runbooks are current, used by the team, and help new hires ramp in weeks not months.

Regulatory Readiness

• SAR filing is timely: 100% of identified reportable activity filed within the 30-day regulatory deadline.
• Audit trails are complete: every decision is logged with who, when, why, what rule or signal triggered it, and what the outcome was.
• Bank sponsor audit documentation is ready on request - no scramble.
• The Risk Intelligence function is documented, scalable, and does not depend on any single person to operate.

What We Offer

• Competitive salary and equity package.
• Comprehensive health, dental, and vision benefits.
• Flexible work arrangements and generous PTO.
• Learning & development budget for conferences, courses, and certifications.
• A direct line to shaping the operational and analytical architecture of a payments risk function scaling to 45x.