Founding Head of Risk

About the Role

Truss is a regulated fintech: real bank accounts, real money movement, cards, payables, receivables. Risk is not a side quest. Every dollar we move is a decision — onboard or don't, pay or hold, release or review — and those decisions have to be fast, sharp, and defensible.

Today a lot of that judgment still lives in the founder's head and in systems that were good enough to get us here. We're hiring the founding head of risk: a person who has built the risk algorithms and rules engines at new fintech companies — the ones that actually catch fraud, abuse, and credit/ops blowups in production — and who wants to do it again as a leader of the function, not a seat inside someone else's.

The bar is specific. We're looking for people who have shipped rules engines, graph/feature pipelines, velocity checks, device and identity signals, manual-review queues, and model-assisted decisioning at places like Venmo, Cash App, or peer fintechs that grew up the hard way. Not "I advised on a fraud roadmap." Not "I sat next to the risk team at a mega-bank." You built it, tuned it, got paged when it broke, and made the loss curve bend.

What You'll Actually Do

• Build the risk function that underpins the product. Rules engines, decisioning flows, scoring, policy creation, case management and the machinery that decides who gets an account, who gets paid, who gets a card limit, and who gets stopped. You design it, you help ship it with engineering, iterate on it, and own the outcomes.
• Own fraud and abuse end-to-end. Account takeover, synthetic identity, payment fraud, check fraud, mule activity, promo/referral abuse, friendly fraud, first-party abuse. Instrument the signals, write the rules, close the loops when attackers adapt.
• Stand up detection → review → action. Queues, SLAs, tooling for ops/CS, clear dispositions, feedback into the engine. Manual review that doesn't become a black hole; automation that doesn't become a false-positive factory.
• Partner with engineering and product. You're not throwing PDFs over the wall. You sit with the people who ship ledger, payments, onboarding, and cards. 
• Tune for a real business, not a demo. False positives kill good contractors. False negatives kill the company. You hold both. You know how to trade loss rate, approval rate, and ops cost with eyes open.
• Cover the regulated surface. BSA/AML and OFAC-aware controls, KYC/KYB quality, transaction monitoring posture, SAR-relevant patterns, bank-partner and sponsor expectations — coordinated with compliance, not outsourced to them.

What We're Looking For

• You've built production risk / fraud systems at a high-growth fintech or payments company — non-negotiable. Rules engines, decisioning platforms, feature stores, graph or link analysis, velocity and device signals, model + rules hybrids. Venmo / Cash App / Stripe / Block / Marqeta / similar caliber experience is the reference class.
• You've done it when the company was still early or scaling hard — messy data, incomplete identity, attackers iterating weekly.
• Deep fluency in how money moves and how it gets stolen: ACH, wires, checks, cards, account funding, payouts, ledger edge cases.
• Strong quantitative and systems instincts. You can reason about precision/recall, dollar-weighted loss, segment-level risk, and rule interactions.
• Ownership mentality. You take the weight off the founder's plate. You make the call, ship the control, and watch the metric.
• Comfortable as the whole function today. No team to hide behind. First you build, then you may hire.
• Fluent with modern tooling (SQL, rules/events stacks, AI as a lever). We're a small, technical company.
• Must be legally authorized to work in the U.S. (or eligible for TN) and willing to be in our San Francisco office in person.

Nice to Haves

• Direct experience with sponsor banks, program managers, or card issuers and the controls they demand.
• You've owned or deeply partnered on AML transaction monitoring, sanctions, or KYC/KYB quality.
• You've built or rebuilt a rules engine / decisioning service (Sift, Alloy, Unit21, Homegrown, etc.) and have scars from both.
• Incident leadership: a real fraud event, a bank partner fire drill, or a loss spike you diagnosed and fixed.
• Enough code to be dangerous (Python/SQL/TypeScript) — you prototype ideas quickly.