HitPay · Remote · Posted 7d ago
================================================================================
ABOUT HITPAY
================================================================================
HitPay is the payments and business operations platform for small and medium
businesses across Southeast Asia and beyond. We process card, e-wallet, bank
transfer, PayNow, QR and card-present payments for tens of thousands of
merchants across Singapore, Malaysia, the Philippines, Hong Kong, Australia and
the United States — through a single onboarding flow, a single dashboard, and a
single API.
Payments is a regulated business. We hold a Major Payment Institution licence
from the Monetary Authority of Singapore and operate under a spread of local
regimes, scheme rules and partner-bank obligations. Today, most of our risk,
fraud and AML capability exists to keep us safe. We believe a meaningful share
of it should also be a product our merchants pay for.
That is the job.
================================================================================
THE ROLE
================================================================================
You will own risk, fraud and compliance as a product line — not as a cost
centre. You are being hired to design, build and ship products that reduce loss,
shorten onboarding, and generate revenue: fraud screening our merchants opt into,
chargeback and dispute tooling they will pay for, underwriting and KYB
capabilities we can sell or embed, monitoring and reporting our larger merchants
and platform partners need in order to grow on us.
This is a builder's role with a regulator's discipline. You will spend your week
between a compliance officer, a backend engineer and a merchant, and you will be
the person who can hold all three conversations without a translator.
================================================================================
WHAT YOU WILL OWN
================================================================================
Revenue products
- Define, price and ship monetisable risk and fraud products: fraud scoring
and screening tiers, chargeback protection and representment tooling,
dispute automation, merchant-facing risk dashboards, KYB / identity
verification as a paid capability, and risk services for platform and
marketplace partners.
- Build the commercial case: attach rate, pricing model, loss economics,
payback. Own the P&L logic of what you ship, not just the roadmap.
- Work with Sales and Partnerships to take these products to market — you will
be in customer calls, and you will lose some of them and learn why.
Compliance and risk engineering
- Own the product surface of transaction monitoring, sanctions and PEP
screening, merchant onboarding and KYB, prohibited-industry and MCC policy
enforcement, and chargeback and fraud loss controls.
- Turn regulatory obligations and internal policy into shipped system
behaviour: rules, thresholds, queues, audit trails, evidence packs,
escalation paths and reporting.
- Drive rule tuning and alert quality as a product metric. False positive
rate, analyst minutes per alert and precision at the top of the queue are
yours to move.
- Evaluate, integrate and manage third-party vendors — fraud engines,
screening providers, device intelligence, identity — including build vs.
buy calls and commercial negotiation support.
Stakeholder leadership
- Be the trusted counterpart to the Compliance and MLRO function. You will not
ship around them, and they will not be surprised by what you ship.
- Handle regulator, partner-bank and scheme-facing product questions:
respond to information requests, explain control design, and evidence that
the system does what the policy says it does.
- Translate between compliance intent and engineering implementation in both
directions, and say plainly when a control cannot be built the way it was
written.
================================================================================
WHAT WE ARE LOOKING FOR
================================================================================
Non-negotiable
- 5+ years in product management, with meaningful time spent on compliance,
risk or fraud engineering INSIDE a payments company — a PSP, acquirer,
payment facilitator, card issuer, remittance provider, digital bank,
marketplace payments team or fraud/RegTech vendor. Adjacent fintech
experience without payments exposure is not a substitute.
- Demonstrated ownership of systems that a regulator, auditor or scheme has
actually examined. You should be able to describe a control you designed and
how it held up under scrutiny.
- Working fluency in the regulation, not a reading knowledge: AML/CFT
obligations and the MAS Payment Services Act notices, or an equivalent
regime you have operated under (BNM, BSP, AUSTRAC, FinCEN, FCA). CDD/KYB,
ongoing monitoring, STR/SAR workflow, sanctions screening, record keeping.
- Card scheme and network risk programmes: Visa VAMP / VDMP, Mastercard
Excessive Fraud and Chargeback programmes, dispute lifecycle and
representment, 3-D Secure and SCA, PCI DSS scope.
- Fluency with data. You can write your own SQL, interrogate a warehouse, size
a rule's impact before proposing it, and refuse a metric that does not hold
up.
- A track record of working with compliance stakeholders as partners — people
whose job is to say no — and shipping anyway, without cutting corners.
Strong signals
- You have taken a risk or fraud capability to market as a paid product, not
just an internal tool.
- Southeast Asian market experience, particularly Singapore, Malaysia or the
Philippines, and comfort with the local payment rails.
- Hands-on with fraud and screening platforms (Forter, Sift, Sardine,
Ravelin, ComplyAdvantage, Flagright, Unit21 or similar) as an operator, not
a buyer on a slide.
- You can prototype. You use AI tooling to move faster and you write enough
code to be dangerous and useful.
- Experience with merchant underwriting and portfolio risk at a payment
facilitator, including reserves, exposure and offboarding decisions.
How you work
- You go find the root cause. You do not ship a workaround and call it done.
- You are opinionated and you show your reasoning, and you change your mind
when the data says so.
- You write clearly. Specs, policy mappings and post-incident write-ups are
part of the job, not an overhead.
- You are comfortable being the person accountable when a control fails.
================================================================================
WHAT SUCCESS LOOKS LIKE
================================================================================
First 90 days
- You know our risk stack end to end: what runs, what is manual, what is
theatre, and where the real losses are coming from.
- You have a documented view of our fraud and chargeback loss economics by
market and by provider, and you have named the top three fixable causes.
- You have shipped at least one improvement to alert quality or onboarding
friction that Compliance and Ops can feel.
First 12 months
- At least one risk or fraud product is live, priced, and generating revenue
with a defensible attach rate.
- Fraud and chargeback loss as a share of processed volume is down, and you
can attribute the movement.
- Compliance review and onboarding turnaround times are materially shorter
without a loosening of standards.
- Our monitoring and screening coverage stands up to a partner-bank or
regulator review without a scramble.
================================================================================
WHY THIS ROLE
================================================================================
- Real ownership. This is a product line, not a backlog. You will set the
strategy and be accountable for the outcome.
- Small team, direct access. You will work with the founders. Decisions take
days, not quarters.
- The problems are genuine. Multi-market regulation, live fraud, real money,
real merchants — and a product surface that almost nobody in this region has
built properly yet.