Requirements
The ideal candidate has experience building production-ready compliance systems including microservices, rule engines, and NLP pipelines. They can translate regulations into actionable tooling, governance, and audit trails, and have experience with AI/ML, blockchain, and digital identity integration for KYC, transaction monitoring, and sanctions screening. Fluency or strong knowledge of GDPR, ISO 27001, and DORA is required, along with the ability to design automated data governance frameworks and build AI-driven risk models.
Description
We're not hiring a compliance officer who flags issues after the fact. We're hiring someone who builds the systems that catch them before they become fines.Why This MattersDeriv's mission is Trading for Anyone, Anywhere, Anytime. Real money, real regulations, real consequences—across every jurisdiction we operate in. Manual compliance doesn't scale to millions of transactions, and rules change faster than any policy team can track by hand.We're building continuous monitoring, automated regulatory intelligence, and audit trails that regulators actually trust—because they're more consistent than human-only review.Why DerivWe're already automating compliance, not planning to.Automated AML review pulling data, computing risk metrics, and flagging high-risk clients without a human running the same query every morning Regulatory research automation: feed in a jurisdiction and licence type, get back applicable laws, requirements, and risk factorsDozens of fraud detection models running continuously in production, watching for money movement patterns and coordinated network behaviourYou'll extend systems already running in production, not pitch ideas that might get funded.ScopeThis is an Individual Contributor role. You'll lead through technical expertise, not people management—though you'll mentor others and shape how the team works.You'll own components within one or two of these areas, with exposure to the rest:Regulatory Monitoring & Intelligence — NLP systems that read global rule changes and surface what actually needs action Onboarding, AML & Fraud Workflows — microservices and rule engines replacing manual review steps RegTech Integration — evaluating and integrating AI/ML, blockchain, and digital identity tools into KYC, transaction monitoring, and sanctions screeningYour day-to-day focus depends on team priorities, but the work touches all three.What You'll DoBuild the regulatory radarDesign systems that aggregate rule changes across jurisdictions, use NLP to work out what they actually mean, and generate alerts with a recommended action attached—not just something changedReplace manual review with working systemsBuild onboarding, AML, and fraud detection workflows on microservices and rule engines that remove hand-offs and catch more than a checklist ever could Turn a regulatory obligation into the tooling, governance, and audit evidence it actually requires—no one hands you that translation, you do itEvaluate and integrate RegTechAssess AI/ML, blockchain, and digital identity tools against real requirements, run proof-of-concept testing, and lead integration into KYC, transaction monitoring, and sanctions screening. Extend blockchain compliance capabilities: crypto transaction monitoring, counterparty risk scoring, and Travel Rule adherenceGovern the data, not just the processDesign automated data governance frameworks aligned to GDPR, ISO 27001, and DORA, with integrity and auditability built in from the start, not bolted on after an audit findingModel the risk, not just the ruleBuild AI-driven risk models and simulations for fraud and operational risk, with outputs a human reviewer can actually interpret and stress-testWho You AreYou've shipped compliance systems that run. Microservices, rule engines, NLP pipelines—you've built them into production, not just described them in a policy document. You can read a regulation and build for it. You translate the obligation into the tooling, governance, and audit trail it needs without waiting for someone else to do that translation.You lead through ambiguity. When a requirement's unclear or priorities compete, you make a call, take feedback, and adjust. You don't wait around for certainty that isn't coming.You mentor without being asked. Newer engineers and analysts on the team learn from how you work, not just from what you tell them.You're fluent in GDPR, ISO 27001, and DORA. Or close enough that you know exactly where to dig deeper. You design governance in, rather than checking for it afterward.The Honest RealityThis is demanding work. You'll own systems where a missed pattern isn't a bug ticket—it's a regulatory finding. You'll balance thorough checking against operational speed, and you'll need to explain what an AI-driven risk model actually decided to people who distrust black boxes by default. You'll lead through requirements that shift mid-build, and mentor while you're still learning some of this yourself.But you'll build compliance technology that scales with transaction volume instead of headcount. You'll work across RegTech, AI, and blockchain in a function most companies still run on spreadsheets and hope.If you want settled specs and stable requirements, this isn't it. If you want to build the systems compliance runs on next, it might be.