Product Manager, Risk and Fraud

================================================================================

ABOUT HITPAY

• ================================================================================
• HitPay is the payments and business operations platform for small and medium
• businesses across Southeast Asia and beyond. We process card, e-wallet, bank
• transfer, PayNow, QR and card-present payments for tens of thousands of
• merchants across Singapore, Malaysia, the Philippines, Hong Kong, Australia and
• the United States — through a single onboarding flow, a single dashboard, and a
• single API.
• Payments is a regulated business. We hold a Major Payment Institution licence
• from the Monetary Authority of Singapore and operate under a spread of local
• regimes, scheme rules and partner-bank obligations. Today, most of our risk,
• fraud and AML capability exists to keep us safe. We believe a meaningful share
• of it should also be a product our merchants pay for.
• That is the job.
• ================================================================================

THE ROLE

• ================================================================================
• You will own risk, fraud and compliance as a product line — not as a cost
• centre. You are being hired to design, build and ship products that reduce loss,
• shorten onboarding, and generate revenue: fraud screening our merchants opt into,
• chargeback and dispute tooling they will pay for, underwriting and KYB
• capabilities we can sell or embed, monitoring and reporting our larger merchants
• and platform partners need in order to grow on us.
• This is a builder's role with a regulator's discipline. You will spend your week
• between a compliance officer, a backend engineer and a merchant, and you will be
• the person who can hold all three conversations without a translator.
• ================================================================================

WHAT YOU WILL OWN

• ================================================================================
• Revenue products
• Define, price and ship monetisable risk and fraud products: fraud scoring
• and screening tiers, chargeback protection and representment tooling,
• dispute automation, merchant-facing risk dashboards, KYB / identity
• verification as a paid capability, and risk services for platform and
• marketplace partners.
• Build the commercial case: attach rate, pricing model, loss economics,
• payback. Own the P&L logic of what you ship, not just the roadmap.
• Work with Sales and Partnerships to take these products to market — you will
• be in customer calls, and you will lose some of them and learn why.
• Compliance and risk engineering
• Own the product surface of transaction monitoring, sanctions and PEP
• screening, merchant onboarding and KYB, prohibited-industry and MCC policy
• enforcement, and chargeback and fraud loss controls.
• Turn regulatory obligations and internal policy into shipped system
• behaviour: rules, thresholds, queues, audit trails, evidence packs,
• escalation paths and reporting.
• Drive rule tuning and alert quality as a product metric. False positive
• rate, analyst minutes per alert and precision at the top of the queue are
• yours to move.
• Evaluate, integrate and manage third-party vendors — fraud engines,
• screening providers, device intelligence, identity — including build vs.
• buy calls and commercial negotiation support.
• Stakeholder leadership
• Be the trusted counterpart to the Compliance and MLRO function. You will not
• ship around them, and they will not be surprised by what you ship.

Handle regulator, partner-bank and scheme-facing product questions

• respond to information requests, explain control design, and evidence that
• the system does what the policy says it does.
• Translate between compliance intent and engineering implementation in both
• directions, and say plainly when a control cannot be built the way it was
• written.
• ================================================================================

WHAT WE ARE LOOKING FOR

================================================================================

Non-negotiable

• 5+ years in product management, with meaningful time spent on compliance,
• risk or fraud engineering INSIDE a payments company — a PSP, acquirer,
• payment facilitator, card issuer, remittance provider, digital bank,
• marketplace payments team or fraud/RegTech vendor. Adjacent fintech
• experience without payments exposure is not a substitute.
• Demonstrated ownership of systems that a regulator, auditor or scheme has
• actually examined. You should be able to describe a control you designed and
• how it held up under scrutiny.
• Working fluency in the regulation, not a reading knowledge: AML/CFT
• obligations and the MAS Payment Services Act notices, or an equivalent
• regime you have operated under (BNM, BSP, AUSTRAC, FinCEN, FCA). CDD/KYB,
• ongoing monitoring, STR/SAR workflow, sanctions screening, record keeping.
• Card scheme and network risk programmes: Visa VAMP / VDMP, Mastercard
• Excessive Fraud and Chargeback programmes, dispute lifecycle and
• representment, 3-D Secure and SCA, PCI DSS scope.
• Fluency with data. You can write your own SQL, interrogate a warehouse, size
• a rule's impact before proposing it, and refuse a metric that does not hold
• up.
• A track record of working with compliance stakeholders as partners — people
• whose job is to say no — and shipping anyway, without cutting corners.
• Strong signals
• You have taken a risk or fraud capability to market as a paid product, not
• just an internal tool.
• Southeast Asian market experience, particularly Singapore, Malaysia or the
• Philippines, and comfort with the local payment rails.
• Hands-on with fraud and screening platforms (Forter, Sift, Sardine,
• Ravelin, ComplyAdvantage, Flagright, Unit21 or similar) as an operator, not
• a buyer on a slide.
• You can prototype. You use AI tooling to move faster and you write enough
• code to be dangerous and useful.
• Experience with merchant underwriting and portfolio risk at a payment
• facilitator, including reserves, exposure and offboarding decisions.

How you work

• You go find the root cause. You do not ship a workaround and call it done.
• You are opinionated and you show your reasoning, and you change your mind
• when the data says so.
• You write clearly. Specs, policy mappings and post-incident write-ups are
• part of the job, not an overhead.
• You are comfortable being the person accountable when a control fails.
• ================================================================================

WHAT SUCCESS LOOKS LIKE

• ================================================================================
• First 90 days
• You know our risk stack end to end: what runs, what is manual, what is
• theatre, and where the real losses are coming from.
• You have a documented view of our fraud and chargeback loss economics by
• market and by provider, and you have named the top three fixable causes.
• You have shipped at least one improvement to alert quality or onboarding
• friction that Compliance and Ops can feel.
• First 12 months
• At least one risk or fraud product is live, priced, and generating revenue
• with a defensible attach rate.
• Fraud and chargeback loss as a share of processed volume is down, and you
• can attribute the movement.
• Compliance review and onboarding turnaround times are materially shorter
• without a loosening of standards.
• Our monitoring and screening coverage stands up to a partner-bank or
• regulator review without a scramble.
• ================================================================================

WHY THIS ROLE

• ================================================================================
• Real ownership. This is a product line, not a backlog. You will set the
• strategy and be accountable for the outcome.
• Small team, direct access. You will work with the founders. Decisions take
• days, not quarters.
• The problems are genuine. Multi-market regulation, live fraud, real money,
• real merchants — and a product surface that almost nobody in this region has
• built properly yet.