FLSA Classification: Exempt

Reports To: Chief Financial Officer (CFO)

Job Summary:

The Compliance & Risk Manager is responsible for managing and executing Blossom’s compliance and risk management programs. Reporting to the CFO, this role oversees day-to-day compliance operations across all regulatory, security, and audit functions—including SOC 2 Type II, PCI DSS, and all compliance obligations associated with Blossom’s hardware and software products while maintaining a risk management framework that identifies, tracks, and mitigates operational, financial, regulatory, and strategic risks. This role collaborates closely with Engineering, Product, Legal, HR, and Operations to support a culture of compliance and risk awareness across the organization. This role works in close partnership with the IT and Infrastructure function, which retains ownership of technical security controls, HSM/key management, and PCI Security; the Compliance & Risk Manager owns program management, audit coordination, the enterprise risk framework, and policy.

Supervisory Responsibilities:

• Support the recruitment and onboarding of compliance and risk staff; provide day-to-day guidance and oversight to any direct reports within the function.

Duties/ Responsibilities:

Audit & Certification Management

• Own the end-to-end SOC 2 Type II audit lifecycle: scope definition, control design, evidence collection, auditor coordination, and remediation tracking.

• Lead PCI DSS compliance efforts across applicable business units, including scope management, gap assessments, and coordination with Qualified Security Assessors (QSAs).

• Manage relationships with external auditors, assessors, and certification bodies; serve as primary point of contact during audit engagements.

• Maintain a comprehensive controls inventory; ensure all controls are documented, tested, and operating effectively.

• Track and manage audit findings and remediation plans through to closure in collaboration with control owners.

Enterprise Risk Management

• Manage and maintain the enterprise risk management (ERM) framework, ensuring risks across operational, regulatory, financial, strategic, and technology domains are identified, assessed, prioritized, and tracked.

• Maintain and update the company-wide risk register; coordinate with risk owners to ensure mitigation and remediation plans are tracked to resolution.

  • Conduct periodic enterprise risk assessments; summarize findings and risk trends for CFO review.

  • Collaborate with Product, Engineering, Finance, HR, and Operations to identify and flag risks associated with new initiatives, product launches, and process changes.

  • Support operational risk programs including business continuity planning (BCP), disaster recovery readiness, and incident response protocols in coordination with IT and Engineering.

  • Administer the third-party and vendor risk assessment process, evaluating vendors for security, financial stability, regulatory alignment, and contractual risk.

  • Monitor the evolving risk landscape—including emerging cyber threats, regulatory changes, and market developments—and flag potential impact to leadership.

  • Support the CFO in maintaining the company’s risk appetite and tolerance thresholds; help ensure business decisions align with established risk parameters.

  • Respond to credit union client risk and security due diligence requests, including vendor questionnaires and risk assessments.

  • Maintain required risk documentation including the risk register, risk appetite statements, and reporting artifacts in a manner that supports executive review and external audit.

Regulatory & Policy Compliance

• Monitor and interpret federal, state, and credit union-specific regulatory requirements applicable to Blossom’s software and hardware products (e.g., NCUA guidance, FFIEC frameworks, GLBA, applicable state laws).

• Maintain and update company-wide compliance policies, standards, and procedures; ensure alignment with regulatory requirements and industry best practices.

• Conduct regular internal audits and control testing to evaluate compliance with applicable laws, regulations, and internal policies.

Hardware & Software Product Compliance

• Ensure Blossom’s hardware and software products comply with applicable regulatory standards, including security and interoperability requirements for financial technology solutions used by credit unions.

• Collaborate with Product and Engineering teams to embed security and compliance requirements into the SDLC and hardware release processes.

• Advise on compliance and risk implications of new product features, APIs, and data integrations with credit union core systems and third-party platforms.

• Ensure the organization meets all data privacy requirements, including applicable provisions of state privacy laws and any credit union member data obligations.

Security Awareness & Training Oversight

• Partner with HR to support compliance training integration into onboarding and ongoing employee development.

• Promote a compliance- and risk-aware culture by supporting cross-functional teams with guidance on regulatory obligations and risk.

Oversee training completion tracking across mandatory platforms (e.g., NINJIO, Udemy Business) and ensure role-specific training obligations are met, including Swipe team PCI requirements.

• Develop and deliver compliance communications, training materials, and policy updates to employees across all departments.

• Coordinate with HR and department heads to ensure annual policy acknowledgments and required compliance certifications are completed on schedule.

• Own the enterprise Security Awareness Training program, ensuring compliance with PCI DSS Requirement and other applicable mandates.

Reporting & Executive Partnership

• Serve as a key point of contact for compliance and risk-related questions and escalations across the organization.

• Provide regular updates to the CFO on the status of the compliance and risk programs, including audit outcomes, risk register updates, and remediation progress.

• Prepare compliance metrics, risk dashboards, and audit findings summaries for CFO and executive review.

• Coordinate with external auditors, regulators, and credit union compliance and risk stakeholders as the day-to-day point of contact.

• Identify and escalate emerging compliance and risk issues to the CFO, with recommended mitigation steps and timelines.

• Collaborate with Legal, Finance, HR, and Operations to support alignment of the compliance and risk programs with company strategy and growth objectives.

• Performs other related duties as assigned.

Required Skills/ Abilities:

• Deep knowledge of SOC 2 Trust Services Criteria (TSC) and experience leading or managing SOC 2 Type II audit engagements from preparation through report issuance.

• Working knowledge of PCI DSS requirements and experience applying them within a fintech, payments, or software organization.

• Familiarity with financial services regulatory frameworks including FFIEC, GLBA, NCUA guidelines, and applicable state consumer protection and data privacy laws.

• Experience developing, implementing, and managing enterprise compliance policies, procedures, risk registers, and controls inventories.

• Demonstrated experience building or managing an enterprise risk management (ERM) framework, including risk registers, risk appetite statements, and risk reporting.

• Strong organizational and project management skills; able to manage multiple compliance and risk workstreams simultaneously with attention to detail.

• Exceptional written and verbal communication skills; able to translate complex regulatory requirements into clear, actionable guidance for technical and non-technical audiences.

• Experience partnering with Engineering and Product teams to embed compliance into software and product development processes.

• Comfort with GRC platforms and risk management tools (e.g., Drata, Vanta, LogicGate, ServiceNow GRC, or similar).

• High integrity, strong judgment, and the ability to operate as a trusted advisor to senior leadership.

• Ability to navigate ambiguity and execute within a fast-growing fintech environment with evolving compliance and risk needs.

• Proficiency with Google Workspace or Microsoft 365 and standard business productivity tools.

Education and Experience:

• Bachelor’s degree in Business, Finance, Legal Studies, Information Systems, or a related field required; Master’s degree a plus.

• Minimum 4+ years of progressive experience in compliance, risk management, audit, or related fields; experience within fintech, payments, or financial services strongly preferred.

• 2 or more years of hands-on experience with SOC 2 audits (as preparer, auditee, or program contributor); experience with PCI DSS compliance strongly preferred.

• 2 or more years of experience in a compliance, risk, or audit role with increasing responsibility, preferably in a growth-stage or mid-market company.

• Prior experience working with or supporting credit unions, community financial institutions, or regulated financial services clients strongly preferred.

• Experience supporting fintech, SaaS, or B2B technology companies serving regulated industries is a plus.

• Relevant professional certifications strongly preferred: CISA, CISM, CRISC, CCEP, CIPP, CFE, or equivalent.

Physical Requirements:

• Prolonged periods sitting at a desk and working on a computer.

• Must be able to lift up to 15 pounds at times.

What We Offer:

• Health, fully covered: Company-paid medical, dental, and vision insurance.

• Life & AD&D: Company-paid life and accidental death & dismemberment coverage.

• Income protection: Company-paid short- and long-term disability.

• 401(k) with match: Save for the long run, and we’ll match.

• Remote allowance: Cell phone and internet connectivity expenses support.

• Flexible spending: FSA and Dependent Care (DCSA) accounts to stretch your pre-tax dollars.

• Unlimited PTO: Take the time you actually need.

• Employee Assistance Program (EAP): Confidential support for life’s harder moments.

• Supplemental coverage: Voluntary insurance options to round out your plan.