The posting
ABOUT AIRWALLEX
Airwallex is the AI-native financial operating system for a real-time, intelligent economy. More than 675,000 businesses, including McLaren Racing, Qantas, SHEIN, and TikTok, use us, directly or through our platform partners, to run their financial operations or build and monetize financial products of their own.
We started in Melbourne in 2015 to build the infrastructure global commerce runs on. We're the regulated backbone behind global payments: not by accident, but by design. A decade plus, 85+ licenses, and a financial infrastructure spanning North America, Europe, the Middle East, and Asia-Pacific.
We're co-headquartered in San Francisco and Singapore, with more than 2,700 people across 27 offices. We hire builders with founder-level energy, people who move fast with good judgment, dig in with real curiosity, and make calls from first principles rather than waiting to be told what to do. Read our operating principles https://www.airwallex.com/en-us/operating-principles to see it in full.
HOW YOU'LL MAKE IMPACT
You’ll build and scale a practical Second Line of Defence technology risk assurance function for a fast-growing, regulated fintech.
- Recruit, mentor, and lead a lean, high-performing team of technology risk engineers and assurance specialists, fostering technical depth, code-first assurance, and cross-functional agility.
- Lead second-line assurance across ITGCs and IT application controls, cloud infrastructure and database management, CI/CD and change enablement, IAM and privileged access, API and automated data pipeline integrity, and business continuity and disaster recovery.
- Build an automation-first assurance engine using AI agents, automated workflows, and custom Python and SQL scripts for continuous control testing, evidence retrieval, and remediation validation.
- Establish automated finding lifecycle and remediation governance, surfacing control failures to engineering leads and validating fixes without drawn-out re-audit cycles.
- Design and execute control frameworks for generative AI, LLMs, agentic workflows, machine learning models, and automated decision engines.
- Partner with external auditors and global regulators to defend autonomous testing scripts and AI-agent methodologies, ensuring automated evidence is trusted and relied upon.
- Translate complex technology risk into clear recommendations for engineers, senior executives, and board-level risk committees, drawing on frameworks and expectations including NIST, ISO 27001, SOC 1, SOC 2, DORA, MAS TRM, FCA, HKMA, ASIC, and FinCEN.
You’ll work from our Amsterdam or London office three days a week.
WHAT WE'RE LOOKING FOR
Essentials
- 8+ years of progressive experience in technology risk, IT audit, information security assurance, or technology compliance, including proven experience in a Second Line of Defence risk assurance capacity.
- Big Four background.
- Experience building and testing risk controls.
- A track record of recruiting, mentoring, and leading high-performing technical risk or assurance teams.
- Deep practical expertise in ITGCs, IT application controls, automated business controls, and SOX compliance within complex distributed architectures.
- Hands-on experience assessing cloud risks across AWS or GCP, particularly IAM, privileged access and segregation of duties, Firefighter workflows, CI/CD pipelines, database controls, and modern API security.
- Practical ability to write and use SQL, Python, or API scripts to query databases, automate evidence extraction, and reduce manual sampling.
- Strong conceptual and practical understanding of risks and controls around AI/ML systems, LLMs, and automated decision engines, including data drift, access guardrails, and model integrity.
- Proven ability to constructively challenge First Line engineering leads while maintaining the credibility to defend automated testing methodologies to external auditors and regulatory examiners.
- Solid working knowledge of industry control frameworks such as SOC 1/2, ISO 27001, and NIST CSF.
Preferred
- Direct experience building or deploying AI agents, LLM-driven audit assistants, or automated compliance and testing pipelines.
- Fintech experience, particularly within a high-growth fintech, payments platform, digital bank, or cloud-native technology company.
- People management experience.
- Familiarity with international financial technology regulations and expectations, including MAS TRM, FCA, HKMA, DORA, ASIC, and FinCEN.
- Experience integrating GRC platforms, BI dashboards such as Tableau or Looker, and continuous compliance monitoring tools.
- Relevant certifications such as CISA, CISSP, CRISC, CISM, or AWS/GCP certifications.
YOU'LL THRIVE HERE IF
- You’re comfortable owning the roadmap yourself.
- You own the outcome and you don't wait for permission to fix what's broken.
- You're comfortable with ambiguity. Give you a problem, not a prescription, and you'll run with it.
- You say what you mean. You're direct, but you lead with respect.
- You simplify complexity rather than hiding behind it.
LEARN MORE ABOUT YOUR TEAM
Risk is part of Regulatory & Compliance at Airwallex.
Regulatory & Compliance is where we build the trust, discipline, and operational resilience required to scale a generational financial platform.
As Airwallex grows across 30+ markets, this team turns regulatory complexity into strategic control. You'll lead compliance, enterprise risk, and regulatory engagement in a way that protects the business while letting it move with conviction. Our ambition goes beyond meeting expectations: we're building a risk posture that acts as a competitive moat, grounded in ownership, proactive regulatory partnerships, and frameworks that scale globally while respecting local nuance.
It's a team for strategic operators with sharp judgment, high standards, and the confidence to execute at pace in a high-stakes environment. You'll thrive here if you can balance rigor with progress and influence across functions.
If you want to architect the benchmark for trust and resilience in global finance, your work here will have a massive impact.
APPLICANT SAFETY POLICY: FRAUD AND THIRD-PARTY RECRUITERS
To protect you from recruitment scams, please be aware that Airwallex will not ask for bank details, sensitive ID numbers (i.e. passport), or any form of payment during the application or interview process. All official communication will come from an @airwallex.com http://airwallex.com email address. Please apply only through careers.airwallex.com http://careers.airwallex.com or our official LinkedIn page.
Airwallex does not accept unsolicited resumes from search firms/recruiters. Airwallex will not pay any fees to search firms/recruiters if a candidate is submitted by a search firm/recruiter unless an agreement has been entered into with respect to specific open position(s). Search firms/recruiters submitting resumes to Airwallex on an unsolicited basis shall be deemed to accept this condition, regardless of any other provision to the contrary.
EQUAL OPPORTUNITY
Airwallex is proud to be an equal opportunity employer. We value diversity and anyone seeking employment at Airwallex is considered based on merit, qualifications, competence and talent. We don’t regard color, religion, race, national origin, sexual orientation, ancestry, citizenship, sex, marital or family status, disability, gender, or any other legally protected status when making our hiring decisions. If you have a disability or special need that requires accommodation, please let us know.
