Product Manager, Risk and Fraud

================================================================================ ABOUT HITPAY ================================================================================ HitPay is the payments and business operations platform for small and medium businesses across Southeast Asia and beyond. We process card, e-wallet, bank transfer, PayNow, QR and card-present payments for tens of thousands of merchants across Singapore, Malaysia, the Philippines, Hong Kong, Australia and the United States — through a single onboarding flow, a single dashboard, and a single API. Payments is a regulated business. We hold a Major Payment Institution licence from the Monetary Authority of Singapore and operate under a spread of local regimes, scheme rules and partner-bank obligations. Today, most of our risk, fraud and AML capability exists to keep us safe. We believe a meaningful share of it should also be a product our merchants pay for. That is the job. ================================================================================ THE ROLE ================================================================================ You will own risk, fraud and compliance as a product line — not as a cost centre. You are being hired to design, build and ship products that reduce loss, shorten onboarding, and generate revenue: fraud screening our merchants opt into, chargeback and dispute tooling they will pay for, underwriting and KYB capabilities we can sell or embed, monitoring and reporting our larger merchants and platform partners need in order to grow on us. This is a builder's role with a regulator's discipline. You will spend your week between a compliance officer, a backend engineer and a merchant, and you will be the person who can hold all three conversations without a translator. ================================================================================ WHAT YOU WILL OWN ================================================================================ Revenue products Define, price and ship monetisable risk and fraud products: fraud scoring and screening tiers, chargeback protection and representment tooling, dispute automation, merchant-facing risk dashboards, KYB / identity verification as a paid capability, and risk services for platform and marketplace partners. Build the commercial case: attach rate, pricing model, loss economics, payback. Own the P&L logic of what you ship, not just the roadmap. Work with Sales and Partnerships to take these products to market — you will be in customer calls, and you will lose some of them and learn why. Compliance and risk engineering Own the product surface of transaction monitoring, sanctions and PEP screening, merchant onboarding and KYB, prohibited-industry and MCC policy enforcement, and chargeback and fraud loss controls. Turn regulatory obligations and internal policy into shipped system behaviour: rules, thresholds, queues, audit trails, evidence packs, escalation paths and reporting. Drive rule tuning and alert quality as a product metric. False positive rate, analyst minutes per alert and precision at the top of the queue are yours to move. Evaluate, integrate and manage third-party vendors — fraud engines, screening providers, device intelligence, identity — including build vs. buy calls and commercial negotiation support. Stakeholder leadership Be the trusted counterpart to the Compliance and MLRO function. You will not ship around them, and they will not be surprised by what you ship. Handle regulator, partner-bank and scheme-facing product questions: respond to information requests, explain control design, and evidence that the system does what the policy says it does. Translate between compliance intent and engineering implementation in both directions, and say plainly when a control cannot be built the way it was written. ================================================================================ WHAT WE ARE LOOKING FOR ================================================================================ Non-negotiable 5+ years in product management, with meaningful time spent on compliance, risk or fraud engineering INSIDE a payments company — a PSP, acquirer, payment facilitator, card issuer, remittance provider, digital bank, marketplace payments team or fraud/RegTech vendor. Adjacent fintech experience without payments exposure is not a substitute. Demonstrated ownership of systems that a regulator, auditor or scheme has actually examined. You should be able to describe a control you designed and how it held up under scrutiny. Working fluency in the regulation, not a reading knowledge: AML/CFT obligations and the MAS Payment Services Act notices, or an equivalent regime you have operated under (BNM, BSP, AUSTRAC, FinCEN, FCA). CDD/KYB, ongoing monitoring, STR/SAR workflow, sanctions screening, record keeping. Card scheme and network risk programmes: Visa VAMP / VDMP, Mastercard Excessive Fraud and Chargeback programmes, dispute lifecycle and representment, 3-D Secure and SCA, PCI DSS scope. Fluency with data. You can write your own SQL, interrogate a warehouse, size a rule's impact before proposing it, and refuse a metric that does not hold up. A track record of working with compliance stakeholders as partners — people whose job is to say no — and shipping anyway, without cutting corners. Strong signals You have taken a risk or fraud capability to market as a paid product, not just an internal tool. Southeast Asian market experience, particularly Singapore, Malaysia or the Philippines, and comfort with the local payment rails. Hands-on with fraud and screening platforms (Forter, Sift, Sardine, Ravelin, ComplyAdvantage, Flagright, Unit21 or similar) as an operator, not a buyer on a slide. You can prototype. You use AI tooling to move faster and you write enough code to be dangerous and useful. Experience with merchant underwriting and portfolio risk at a payment facilitator, including reserves, exposure and offboarding decisions. How you work You go find the root cause. You do not ship a workaround and call it done. You are opinionated and you show your reasoning, and you change your mind when the data says so. You write clearly. Specs, policy mappings and post-incident write-ups are part of the job, not an overhead. You are comfortable being the person accountable when a control fails. ================================================================================ WHAT SUCCESS LOOKS LIKE ================================================================================ First 90 days You know our risk stack end to end: what runs, what is manual, what is theatre, and where the real losses are coming from. You have a documented view of our fraud and chargeback loss economics by market and by provider, and you have named the top three fixable causes. You have shipped at least one improvement to alert quality or onboarding friction that Compliance and Ops can feel. First 12 months At least one risk or fraud product is live, priced, and generating revenue with a defensible attach rate. Fraud and chargeback loss as a share of processed volume is down, and you can attribute the movement. Compliance review and onboarding turnaround times are materially shorter without a loosening of standards. Our monitoring and screening coverage stands up to a partner-bank or regulator review without a scramble. ================================================================================ WHY THIS ROLE ================================================================================ Real ownership. This is a product line, not a backlog. You will set the strategy and be accountable for the outcome. Small team, direct access. You will work with the founders. Decisions take days, not quarters. The problems are genuine. Multi-market regulation, live fraud, real money, real merchants — and a product surface that almost nobody in this region has built properly yet. Visa: US citizenship/visa not required.