Risk Associate

Lithic is the modern card issuing and processing platform empowering ambitious financial companies to build the future of payments.

Our infrastructure powers card programs for 100+ innovative clients, from fintechs reimagining credit and digital banking to platforms transforming disbursements and spend management. Companies like Mercury, Flex, and Novo rely on Lithic's developer-friendly APIs, direct network connections, and flawless reconciliation to launch and scale card programs in weeks, not years.

We're building a future where access to better financial products materially improves people's lives, free from the constraints of 30-year-old mainframes and legacy processors. We're proud to be backed by world-class investors who share that vision, including Bessemer Venture Partners, Index Ventures, Spark Capital, Stripes, and Mastercard, along with many others. 

We're a team of 170+ across 26 states and 7 countries, headquartered in New York City. 

We are hiring a Senior Risk Associate to run Lithic's risk assessment function: the client risk assessment program, the third party risk management program, and the enterprise risk assessment. You will execute the assessments, own the operations that keep them on schedule and defensible, and continuously improve the rubrics, questionnaires, registers, and SOPs that govern them. You will also own program underwriting: the criteria, limit and reserve recommendations, and periodic reassessment that follow a client from diligence through scale.

This is an AI-forward role. Lithic is deploying agentic tooling across diligence and documentation workflows, and this role owns that build in the assessment domain: testing, tuning, and documenting the tooling so routine collection, review, and drafting are absorbed by automation, while you own the judgment calls, the exceptions, and the written product that goes to partner banks and examiners.

This role operates with limited guidance and owns its programs end to end. It is sized for ownership, orchestration, and judgment rather than queue/ticket processing.

What you'll do:

• Execute client risk assessments end to end: document collection, interviews, scoring against the weighted risk typologies, written assessment, tier determination, and pre-launch conditions.
• Own program underwriting: apply and maintain underwriting criteria, recommend spend, transfer, and reserve limits, and reassess programs as volume, product mix, and financial condition change.
• Run third party risk operations: vendor intake and tiering, due diligence and certification report review, control effectiveness ratings, the vendor risk register, annual reviews, and vendor issue and incident tracking.
• Support the enterprise risk assessment and the risk register: maintain the assessment inventory and calendar, collect and test control evidence, apply the enterprise rating methodology consistently across sub-assessments, and prepare Enterprise Risk Committee materials.
• Continuously improve the programs: refine rubrics, weights, questionnaires, and templates based on observed outcomes, and author and maintain the SOPs that make each assessment repeatable by someone other than you.
• Test, deploy, and tune agentic tooling across the assessment workflows, including document review, questionnaire analysis, vendor due diligence, and drafting, and document the context that makes the output repeatable and defensible.
• Define and report the KPIs and KRIs for the assessment programs, and surface concentration, trend, and thematic findings to leadership and oversight forums.
• Serve as the evidence owner for partner bank, audit, and examiner requests touching client, third party, and enterprise risk assessment.
• Mentor and cross-train teammates on assessment methodology, scoring discipline, and the tooling.

What you'll bring:

• Hands-on experience conducting risk assessments in fintech, payments, or banking, across client or counterparty, third party or vendor, and enterprise or operational risk.
• Working knowledge of underwriting fundamentals: financial statement review, liquidity and runway analysis, loss and exposure monitoring, and limit setting.
• Fluency with rubric-based scoring methodologies and the discipline to apply them consistently and defend a rating.
• A track record of owning discrete risk programs end to end with limited guidance, including authoring the SOPs and defining the metrics that govern them.
• Ability to read control reports (ISO 27001, SOC 2 Type II, PCI DSS AOC) and translate findings into a residual risk position and a remediation ask.
• Comfort working with AI-assisted or agentic tooling, including how to test, tune, document, and defend AI-assisted decisions to bank partners and regulators
• Self-starter who can create structure where none exists and knows when to escalate and collaborate
• Clear, concise writing under a compliance standard: assessments, memos, and committee materials that hold up in front of a partner bank or an examiner.

The annual US salary range for this role is $86,000 - $144,000, plus equity. This salary range may be inclusive of several career levels at Lithic and will be narrowed during the interview process based on the candidate’s experience and qualifications. 

Benefits for Full-Time US Employees:

• Unlimited PTO
• 12-weeks fully paid parental leave
• 4-Week Fully Paid Sabbatical (earned at your 5-year anniversary)
• Work From Anywhere: work from anywhere in the world 4-weeks each year
• 3% cashback on card purchases with your complimentary Privacy.com employee account
• Health, vision, and dental insurance; HSA Contribution Match
• 401(k) match
• Voluntary Life Insurance and STD/LTD

NYC-based employees work from our SoHo office three days a week. Tuesdays and Thursdays are our core days, and you'll choose a third day that works for your schedule and team needs.

In-office employees receive: 

• Commuter benefit
• Catered lunch every Tuesday and Thursday