Compliance and Risk Manager

About Zact Zact is a fintech innovator dedicated to helping organizations simplify expense and payment management. Our platform aligns employees, finance, and accounting with stronger controls, cleaner workflows, and continuous reconciliation to financial systems. We partner with banks and other financial institutions to deliver modern commercial card, expense management, accounts payable, travel, and related payment capabilities.

Zact is seeking a Compliance & Risk Manager to own the day-to-day operation of key elements of our compliance program across audit, privacy, and financial-crime oversight. This is a hands‑on role responsible for coordinating Zact's SOC and PCI audits, managing compliance with GDPR and other applicable privacy laws, supporting compliance monitoring and testing, and overseeing Zact's responsibilities related to BSA, AML, and OFAC.

Because Zact distributes its platform through financial institutions, the BSA/AML/OFAC component of the role is primarily focused on monitoring and documenting the compliance activities of our reseller bank partners, confirming that assigned responsibilities are being performed, and supporting related audits, examinations, and due diligence reviews. This role is not intended to serve as a bank's BSA Officer or perform the bank's core transaction‑monitoring function.

Instead, the Compliance & Risk Manager will ensure that Zact maintains appropriate oversight, documentation, escalation, and evidence regarding the compliance responsibilities performed by its financial institution partners. The Compliance & Risk Manager will report to the Chief Compliance Officer and work closely with Security, Legal, Operations, Engineering, Finance, and our bank partners.

• Coordinate Zact's annual SOC 1 and SOC 2 audit processes, including audit planning, evidence collection, auditor requests, control-owner coordination, and remediation activities.
• Coordinate PCI DSS assessments and related compliance activities.
• Maintain audit calendars, evidence repositories, control documentation, and supporting records.
• Work with internal control owners to ensure required controls are performed and appropriately documented throughout the year.
• Track audit findings, exceptions, and remediation items through completion.
• Serve as a primary operational contact for external auditors and assessors.
• Help maintain continuous audit readiness rather than preparing only at the time of an assessment.

• Manage Zact's operational compliance with GDPR and other applicable privacy laws and regulations.
• Maintain and coordinate privacy policies, procedures, data inventories, retention requirements, and supporting documentation.
• Work with Legal, Security, Engineering, and business teams to incorporate privacy requirements into Zact's products and operations.
• Coordinate responses to privacy‑related customer and bank due diligence requests.
• Support privacy assessments, audits, and remediation activities.
• Monitor changes in applicable privacy requirements and coordinate necessary updates to Zact's controls, policies, and procedures.

• Manage Zact's oversight program for BSA, AML, and OFAC activities performed by reseller bank partners.
• Confirm that applicable bank partners maintain appropriate BSA/AML and OFAC programs and perform the responsibilities assigned to them.
• Collect and review required certifications, policies, audit reports, testing results, or other evidence from bank partners.
• Maintain documentation demonstrating Zact's ongoing oversight of reseller bank compliance activities.
• Identify gaps, exceptions, or missing evidence and coordinate follow‑up with the appropriate bank…