The posting
We're not hiring a compliance officer who flags issues after the fact. We're hiring someone who builds the systems that catch them before they become fines. Why This Matters Deriv's mission is Trading for Anyone, Anywhere, Anytime. Real money, real regulations, real consequences—across every jurisdiction we operate in. Manual compliance doesn't scale to millions of transactions, and rules change faster than any policy team can track by hand. We're building continuous monitoring, automated regulatory intelligence, and audit trails that regulators actually trust—because they're more consistent than human-only review. Why Deriv We're already automating compliance, not planning to. Automated AML review pulling data, computing risk metrics, and flagging high-risk clients without a human running the same query every morning Regulatory research automation: feed in a jurisdiction and licence type, get back applicable laws, requirements, and risk factors Dozens of fraud detection models running continuously in production, watching for money movement patterns and coordinated network behaviour You'll extend systems already running in production, not pitch ideas that might get funded. Scope This is an Individual Contributor role. You'll lead through technical expertise, not people management—though you'll mentor others and shape how the team works. You'll own components within one or two of these areas, with exposure to the rest: Regulatory Monitoring & Intelligence — NLP systems that read global rule changes and surface what actually needs action Onboarding, AML & Fraud Workflows — microservices and rule engines replacing manual review steps RegTech Integration — evaluating and integrating AI/ML, blockchain, and digital identity tools into KYC, transaction monitoring, and sanctions screening Your day-to-day focus depends on team priorities, but the work touches all three. What You'll Do Build the regulatory radar Design systems that aggregate rule changes across jurisdictions, use NLP to work out what they actually mean, and generate alerts with a recommended action attached—not just "something changed" Replace manual review with working systems Build onboarding, AML, and fraud detection workflows on microservices and rule engines that remove hand-offs and catch more than a checklist ever could Turn a regulatory obligation into the tooling, governance, and audit evidence it actually requires—no one hands you that translation, you do it Evaluate and integrate RegTech Assess AI/ML, blockchain, and digital identity tools against real requirements, run proof-of-concept testing, and lead integration into KYC, transaction monitoring, and sanctions screening. Extend blockchain compliance capabilities: crypto transaction monitoring, counterparty risk scoring, and Travel Rule adherence Govern the data, not just the process Design automated data governance frameworks aligned to GDPR, ISO 27001, and DORA, with integrity and auditability built in from the start, not bolted on after an audit finding Model the risk, not just the rule Build AI-driven risk models and simulations for fraud and operational risk, with outputs a human reviewer can actually interpret and stress-test Who You Are You've shipped compliance systems that run. Microservices, rule engines, NLP pipelines—you've built them into production, not just described them in a policy document. You can read a regulation and build for it. You translate "the obligation" into "the tooling, governance, and audit trail it needs" without waiting for someone else to do that translation. You lead through ambiguity. When a requirement's unclear or priorities compete, you make a call, take feedback, and adjust. You don't wait around for certainty that isn't coming. You mentor without being asked. Newer engineers and analysts on the team learn from how you work, not just from what you tell them. You're fluent in GDPR, ISO 27001, and DORA. Or close enough that you know exactly where to dig deeper. You design governance in, rather than checking for it afterward. The Honest Reality This is demanding work. You'll own systems where a missed pattern isn't a bug ticket—it's a regulatory finding. You'll balance thorough checking against operational speed, and you'll need to explain what an AI-driven risk model actually decided to people who distrust black boxes by default. You'll lead through requirements that shift mid-build, and mentor while you're still learning some of this yourself. But you'll build compliance technology that scales with transaction volume instead of headcount. You'll work across RegTech, AI, and blockchain in a function most companies still run on spreadsheets and hope. If you want settled specs and stable requirements, this isn't it. If you want to build the systems compliance runs on next, it might be.
