Risk Intelligence Lead

About the Role Forward's Risk and Compliance Operations is scaling to support 45x merchant volume without 45x headcount. The only way that works is if the function gets smarter faster than it grows. That is what this role exists to build. The Risk Intelligence Lead owns the analytical core of RCO. You will build the intelligence layer that powers decision-making across the function: dashboards that surface trends, patterns, and anomalies before they become incidents; AI-assisted workflows that compress review time and reduce manual effort; SQL infrastructure that turns raw operational data into forward-looking signals; and the automation that systematically eliminates the manual work that does not need to be manual. What makes this role distinct is where the intelligence comes from. You do not study the operation from a distance - you sit in it. Reviewing alerts and cases, working through merchant applications, understanding the day-to-day rhythm of the work is what gives you the pattern recognition to build systems that actually work. The best analytical infrastructure is built by someone who has lived the friction, not just modeled it. This is a build role at a company scaling fast. The person who does this well will shape what the RCO function looks like at 10x, 20x, 50x - and will grow directly with it. Key Responsibilities Own the Day-to-Day Merchant Lifecycle Manage the merchant application review queue: evaluate onboarding submissions for accuracy, completeness, and risk indicators - including multi-layered KYB verification (legal structure, beneficial ownership, UBO identification, PEP and sanctions screening) and Enhanced Due Diligence for high-risk merchant segments. Apply risk-based profiling: stratify incoming applications by geography, industry, transaction profile, and ownership structure - calibrating review depth to risk tier (standard, elevated, EDD) rather than applying uniform scrutiny to every application. Oversee bank account linking and verification, troubleshooting exceptions and monitoring for suspicious changes: account swaps pre- or post-large transaction clusters, mismatched ownership, high-risk bank patterns. Review and action transaction monitoring and fraud cases within defined SLA tiers: Tier 1 high-risk cases under 4 hours, Tier 2 medium-risk cases under 24 hours. Escalate where policy-level judgment is required. Handle bank returns, disputes, and chargeback escalations with timely resolution - operating within Visa VAMP and Mastercard ACMP thresholds, which now govern both fraud and chargeback disputes in a single consolidated ratio with consequences for exceeding them. Act as subject matter expert for onboarding and operational risk - training and guiding junior team members as the function scales, building playbooks that help others reach your level of judgment. Identify Patterns and Act on Them Monitor onboarding, TM, and fraud queues not just case by case, but across the cohort: "why do merchants in this vertical have 3x the chargeback rate of others?" is as important as "what do I do with this one case?" Own the auto-adjudication boundary: define what should be handled without manual touch (low-risk, clean profile, within thresholds) versus what requires human review - and push that boundary forward systematically. Target: 70%+ of cases handled without manual touch, growing month-over-month. Perform root cause analysis on recurring issues and own the fix through to deployment. Not just "I found it" - "I fixed it." Partner with Engineering to translate operational patterns into Taktile rule changes, Metabase dashboards, Retool screen improvements, or CommsHub triggers. Build the Intelligence Layer Own the SQL-based reporting and analytical infrastructure that powers RCO decision-making: activation trends, TM alert patterns, onboarding funnel drop-off, chargeback attribution, volume anomalies, and VAMP/ACMP ratio tracking against Visa and Mastercard program thresholds by partner and vertical. Design and operate AI-assisted review workflows: LLM-based case summarization (using Snowflake Cortex or equivalent) that distills merchant application context, KYC documents, and prior case history into a reviewable brief before a human touches the case. Build Taktile AI agents that handle multi-step investigative tasks - sanctions check, UBO verification, risk score retrieval, reviewer routing - as a single agentic workflow rather than a sequence of manual steps. Build and maintain the Metabase dashboards and operational views that give the RCO team real-time visibility: alert volume and SLA attainment by tier, auto-adjudication rate trending, false positive rate by rule, merchant health scorecards, and chargeback rate by partner and vertical. Translate raw warehouse data into forward-looking signals: surface where volume, risk, or friction is trending adverse before it becomes an incident. Anomaly detection that fires at the pattern level, not just the individual case level. Own model literacy for the team: interpret and act on fraud model outputs (risk scores, confidence signals, anomaly flags) from the Risk Data Scientist, and translate them into operational decisions and rule threshold adjustments in Taktile. Drive Automation and Tooling Identify manual workflows that can be eliminated through Python scripting, automation, or AI tooling - and own delivery of those improvements through to deployment. Examples: hourly scripts that pull high-risk merchant alerts and route them; daily scripts that check metrics against thresholds and fire Slack notifications; webhook-triggered agentic workflows that kick off investigation steps the moment a flag fires. Maintain SOPs that reflect how the team actually operates - living playbooks, not static documentation. Every new process you build gets a runbook. Every runbook gets maintained. Spec, test, and validate operational tooling in partnership with Engineering;