Compliance & Risk Manager

FLSA Classification: Exempt Reports To: Chief Financial Officer (CFO) Job Summary: The Compliance & Risk Manager is responsible for managing and executing Blossom’s compliance and risk management programs. Reporting to the CFO, this role oversees day-to-day compliance operations across all regulatory, security, and audit functions—including SOC 2 Type II, PCI DSS, and all compliance obligations associated with Blossom’s hardware and software products while maintaining a risk management framework that identifies, tracks, and mitigates operational, financial, regulatory, and strategic risks. This role collaborates closely with Engineering, Product, Legal, HR, and Operations to support a culture of compliance and risk awareness across the organization. This role works in close partnership with the IT and Infrastructure function, which retains ownership of technical security controls, HSM/key management, and PCI Security; the Compliance & Risk Manager owns program management, audit coordination, the enterprise risk framework, and policy. Supervisory Responsibilities: Support the recruitment and onboarding of compliance and risk staff; provide day-to-day guidance and oversight to any direct reports within the function. Duties & Responsibilities: Audit & Certification Management Own the end-to-end SOC 2 Type II audit lifecycle: scope definition, control design, evidence collection, auditor coordination, and remediation tracking. Lead PCI DSS compliance efforts across applicable business units, including scope management, gap assessments, and coordination with Qualified Security Assessors (QSAs). Manage relationships with external auditors, assessors, and certification bodies; serve as primary point of contact during audit engagements. Maintain a comprehensive controls inventory; ensure all controls are documented, tested, and operating effectively. Track and manage audit findings and remediation plans through to closure in collaboration with control owners. Enterprise Risk Management Manage and maintain the enterprise risk management (ERM) framework, ensuring risks across operational, regulatory, financial, strategic, and technology domains are identified, assessed, prioritized, and tracked. Maintain and update the company-wide risk register; coordinate with risk owners to ensure mitigation and remediation plans are tracked to resolution. Conduct periodic enterprise risk assessments; summarize findings and risk trends for CFO review. Collaborate with Product, Engineering, Finance, HR, and Operations to identify and flag risks associated with new initiatives, product launches, and process changes. Support operational risk programs including business continuity planning (BCP), disaster recovery readiness, and incident response protocols in coordination with IT and Engineering. Administer the third-party and vendor risk assessment process, evaluating vendors for security, financial stability, regulatory alignment, and contractual risk. Monitor the evolving risk landscape—including emerging cyber threats, regulatory changes, and market developments—and flag potential impact to leadership. Support the CFO in maintaining the company’s risk appetite and tolerance thresholds; help ensure business decisions align with established risk parameters. Respond to credit union client risk and security due diligence requests, including vendor questionnaires and risk assessments. Maintain required risk documentation including the risk register, risk appetite statements, and reporting artifacts in a manner that supports executive review and external audit. Regulatory & Policy Compliance Monitor and interpret federal, state, and credit union-specific regulatory requirements applicable to Blossom’s software and hardware products (e.g., NCUA guidance, FFIEC frameworks, GLBA, applicable state laws). Maintain and update company-wide compliance policies, standards, and procedures; ensure alignment with regulatory requirements and industry best practices. Conduct regular internal audits and control testing to evaluate compliance with applicable laws, regulations, and internal policies. Hardware & Software Product Compliance Ensure Blossom’s hardware and software products comply with applicable regulatory standards, including security and interoperability requirements for financial technology solutions used by credit unions. Collaborate with Product and Engineering teams to embed security and compliance requirements into the SDLC and hardware release processes. Advise on compliance and risk implications of new product features, APIs, and data integrations with credit union core systems and third-party platforms. Ensure the organization meets all data privacy requirements, including applicable provisions of state privacy laws and any credit union member data obligations. Security Awareness & Training Oversight Partner with HR to support compliance training integration into onboarding and ongoing employee development. Promote a compliance- and risk-aware culture by supporting cross-functional teams with guidance on regulatory obligations and risk. Oversee training completion tracking across mandatory platforms (e.g., NINJIO, Udemy Business) and ensure role‑specific training obligations are met, including Swipe team PCI requirements. Develop and deliver compliance communications, training materials, and policy updates to employees across all departments. Coordinate with HR and department heads to ensure annual policy acknowledgments and required compliance certifications are completed on schedule. Own the enterprise Security Awareness Training program, ensuring compliance with PCI DSS Requirement and other applicable mandates. Reporting & Executive Partnership Serve as a key point of contact for compliance and risk-related questions and escalations across the organization. Provide regular updates to the CFO on the status of the compliance and risk programs, including audit outcomes, risk register updates, and remediation progress. Prepare compliance metrics, risk dashboards, and audit findings summaries for CFO and executive review. Coordinate with external auditors, regulators, and credit union compliance and risk stakeholders as the day-to-day point of contact. Identify and escalation emerging compliance and risk issues to the CFO, with recommended mitigation steps and timelines. Collaborate with Legal, Finance, HR, and Operations to support alignment of the compliance and risk programs with company strategy and growth objectives. Performs other related duties as assigned. Required Skills / Abilities: Deep knowledge of SOC 2 Trust Services Criteria (TSC) and experience leading or managing SOC 2 Type II audit engagements from preparation through report issuance. Working knowledge of PCI DSS requirements and experience applying them within a fintech, payments, or software organization. Familiarity with financial services regulatory frameworks including FFIEC, GLBA, NCUA guidelines, and applicable state consumer protection and data privacy laws. Experience developing, implementing, and managing enterprise compliance policies, procedures, risk registers, and controls inventories. Demonstrated experience building or managing an enterprise risk management (ERM) framework, including risk registers, risk appetite statements, and risk reporting. Strong organizational and project management skills; able to manage multiple compliance and risk workstreams simultaneously with attention to detail. Exceptional written and verbal communication skills; able to translate complex regulatory requirements into clear, actionable guidance for technical and non-technical audiences. Experience partnering with Engineering and Product teams to embed compliance into software and product development processes. Comfort with GRC platforms and risk management tools (e.g., Drata, Vanta, LogicGate, ServiceNow GRC, or similar). High integrity, strong judgment, and the ability to operate as a trusted advisor to senior leadership. Ability to navigate ambiguity and execute within a fast-growing fintech environment with evolving compliance and risk needs. Proficiency with Google Workspace or Microsoft 365 and standard business productivity tools. Education and Experience: Bachelor’s degree in Business, Finance, Legal Studies, Information Systems, or a related field required; Master’s degree a plus. Minimum 4+ years of progressive experience in compliance, risk management, audit, or related fields; experience within fintech, payments, or financial services strongly preferred. 2 or more years of hands‑on experience with SOC 2 audits (as preparer, auditee, or program contributor); experience with PCI DSS compliance strongly preferred. 2 or more years of experience in a compliance, risk, or audit role with increasing responsibility, preferably in a growth‑stage or mid‑market company. Prior experience working with or supporting credit unions, community financial institutions, or regulated financial services clients strongly preferred. Experience supporting fintech, SaaS, or B2B technology companies serving regulated industries is a plus. Relevant professional certifications strongly preferred: CISA, CISM, CRISC, CCEP, CIPP, CFE, or equivalent. Physical Requirements: Prolonged periods sitting at a desk and working on a computer. Must be able to lift up to 15 pounds at times. What We Offer: Health, fully covered: Company-paid medical, dental, and vision insurance. Life & AD&D: Company-paid life and accidental death & dismemberment coverage. Income protection: Company-paid short- and long-term disability. 401(k) with match: Save for the long run, and we’ll match. Remote allowance: Cell phone and internet connectivity expenses support. Flexible spending: FSA and Dependent Care (DCSA) accounts to stretch your pre‑tax dollars. Unlimited PTO: Take the time you actually need. Employee Assistance Program (EAP): Confidential support for life’s harder moments. Supplemental coverage: Voluntary insurance options to round out your plan. #J-18808-Ljbffr Blossom