Individual Contributor role — you'll lead through analysis and judgment, not people management.
We're not hiring someone to fill out risk registers. We're hiring someone to figure out why a risk model missed something last quarter — and build the system that catches it next time.
Why this mattersDeriv's mission is Trading for Anyone, Anywhere, Anytime. Millions of traders, in multiple currencies, across regulatory regimes, around the clock. At that scale, risk doesn't wait for a quarterly review cycle — it moves as fast as the market does.
Real money, real regulations, real consequences. We're already building risk operations that run continuously: dozens of fraud detection models flagging money-movement patterns and trading abuse in production, AML review pulling risk metrics automatically instead of by hand, and vendor risk assessments run through document analysis instead of a checklist. Not experiments — systems that are already catching things a person reviewing spreadsheets would miss. You'll own the next layer of that.
Why DerivWe're in production, not planning.
We've proved the model works. You're not waiting for a pilot to get approved — you're extending something that already runs.
Scope of WorkFive things sit with you. All of them cover the entire business — financial and non-financial risk, every entity, every jurisdiction:
Risk Framework Ownership — Owning the enterprise risk framework end to end: taxonomy, appetite, assessment methodology and the control mapping underneath it. Market, credit, counterparty, liquidity and capital risk sit here alongside operational, technology, third-party, conduct, financial crime and strategic risk.
Regulatory Obligations Across Jurisdictions — Owning the risk view of everything each licence demands: prudential and capital requirements, client money and safeguarding, leverage and product rules, conduct and client outcomes, financial crime, reporting, outsourcing, resilience and governance. Keeping it consistent where jurisdictions differ, and turning regulatory change into action with lead time.
Predictive Risk — Building the forward-looking layer of the risk function. Leading indicators, predictive models, emerging risk identification and horizon scanning, so exposure gets flagged while it’s still cheap to fix rather than explained after it isn’t.
Testing, Monitoring & Remediation — Stress testing, scenario design, control testing, KRIs and risk reporting — and then chasing remediation until the exposure is measurably smaller, not just documented.
AI-Driven Transformation — Building the tools. Designing and deploying the models, automated monitoring and analytics the risk function runs on, embedding them into daily workflow, and governing them so the output can be trusted.
What You'll DoOwn The Framework Across The Whole Business
Own the regulatory picture
Predict, don't react
Test it, then drive it down
Build the AI the function runs on
Who You AreYou've managed risk across a whole business, not one segment of it. 5-8 years in risk management within financial services, trading or a regulated brokerage, covering financial and non-financial risk. You can go from a capital calculation to a vendor concentration issue to a conduct risk assessment in the same week and be credible in all three. You think in exposure, not in process — you can see where an operation is fragile before a test proves it.
You've built a framework someone actually used. Taxonomy, appetite, methodology, indicators, reporting. You know which parts change behaviour and which parts just generate paper. And you finish things: you follow actions to closure and check the risk moved, because an action closed on a tracker that left the exposure where it was isn't closed.
You know CFD products, the platforms they run on, and the regulation around both. Required. Leverage, margin, negative balance protection, hedging models, client positioning — and how each turns into exposure. Prudential and capital frameworks: IFR/IFD, Basel principles as applied to investment firms, MiFID II conduct requirements. You can read a licence condition in any jurisdiction and say what it means operationally.
You work forward, not backward. You're more interested in what's coming than what already happened, and you can point to a time you flagged something before it became a problem and explain how you knew. You've built leading indicators or predictive analysis that changed a decision, not just a report.
You build AI, you don't just use it. Comfortable in large datasets and confident with the statistics behind a model. You've built or deployed something that runs in production — automated monitoring, a predictive model, an analytics pipeline — and embedded it into how a team works, not left it as a proof of concept. You understand where models are strong, where they need a person, and how to govern the difference. You don't need direct reports to have influence: when your assessment says something matters, people act on it because the reasoning holds.
The Honest RealityThis is demanding work. You'll own outcomes with incomplete data, because incomplete data is the only kind risk work ever gets. You'll navigate friction between trading, compliance, and leadership when they all want different answers. You'll establish standards that other analysts get measured against, and defend a risk finding to stakeholders who'd rather it wasn't true.
But you'll build frameworks that outlast the quarter they were written for. You'll work with AI tools that make your analysis sharper instead of slower. And you'll know that when you flag something, it's the reason it got fixed before it became a headline.
If you want risk work that's mostly documentation, this isn't it. If you want to find what the models miss, it might be.
