At least 8 years of experience across risk, compliance, or financial services regulation, including experience inside an Australian credit licensee.
Personal ownership of a compliance and risk framework rather than advisory-only experience.
Working knowledge of the National Consumer Credit Protection Act, National Credit Code, relevant Australian Securities and Investments Commission regulatory guides, Anti-Money Laundering and Counter-Terrorism Financing Act, and Privacy Act as they apply to a credit provider.
Experience working in a business with approximately 150 or fewer people.
Experience identifying, assessing, and monitoring operational risks and controls, including registers, incidents, remediation, and emerging risk.
Ability to translate regulatory obligations into controls that staff will follow.
Commercial judgment to distinguish risks that threaten the license from risks that are merely untidy.
Ability to build trust with frontline, sales, and product teams while maintaining second-line independence.
Ability to produce clear written board papers.
Responsibilities
Own and deepen the compliance obligations register across the National Consumer Credit Protection Act, National Credit Code, relevant Australian Securities and Investments Commission regulatory guides, Anti-Money Laundering and Counter-Terrorism Financing Act, Privacy Act, Consumer Data Right regime, and Australian Financial Complaints Authority obligations.
Own the enterprise risk register, including first-line owners, control-effectiveness assessments, remediation tracking, and periodic review.
Own the risk appetite statement and express it in operationally usable terms.
Design and run a rolling compliance monitoring and testing plan across origination, servicing, collections, and hardship.
Own the compliance calendar and policy suite covering complaints, breach reporting, Anti-Money Laundering and Counter-Terrorism Financing, privacy, Consumer Data Right, hardship, conflicts, and outsourcing.
Own target market determination and design and distribution obligations review processes.
Ensure distribution through broker, aggregator, white-label, and direct channels is consistent with each target market determination and that reasonable steps can be evidenced.
Use complaints, Australian Financial Complaints Authority themes, distributor and broker reporting, arrears and hardship experience, and product outcome data in target market determination reviews.
Participate early in product development to shape compliant product design.
Own the internal dispute resolution framework under Regulatory Guide 271, including response timeframes, decision quality, and systemic issues processes.
Own Australian Financial Complaints Authority membership obligations and six-monthly internal dispute resolution data reporting to the Australian Securities and Investments Commission.
Own hardship obligations and related regulatory reporting, and use hardship volumes to inform product and policy decisions.
Own the incident and breach register, including root-cause analysis, remediation tracking, and reportable-situations assessment under Regulatory Guide 78.
Own and mature the operational risk framework, including control design and testing, incident themes, and emerging risk.
Own the outsourcing and third-party register and assess material service providers and their subcontractors.
Own business continuity and disaster recovery planning and maintain evidence that plans have been tested.
Meet operational risk expectations imposed by Australian deposit-taking institution funders.
Own the Anti-Money Laundering and Counter-Terrorism Financing program, including transition to reformed obligations, customer due diligence oversight, transaction monitoring, Australian Transaction Reports and Analysis Centre reporting, independent evaluation, and remediation.
Own the Consumer Data Right position and requirements, including compliance and reporting relationships with the Australian Competition and Consumer Commission and Office of the Australian Information Commissioner, and maintain compliance with Consumer Data Standards.
Own privacy compliance, including the Privacy Act, Australian Privacy Principles, privacy policy, collection notices, third-party data flows, and eligible data-breach assessment and notification.
Own the contract register, template agreements, and contracting playbook.
Select, brief, and manage external counsel and own the legal budget.
Track conditions subsequent and ongoing obligations under funding and partnership agreements.
Escalate contentious, novel, or funding-structure matters to external counsel.
Own the Risk Committee pack and risk section of board reporting, covering material risks, emerging themes, control weaknesses, and overdue remediation.
Support Risk Committee operations and track action registers through completion.
Act as the contact for funder, rating-agency, and auditor due diligence on the risk and compliance framework.
Use product and engineering support to automate compliance processes, exception detection, and breach detection.
Design and deliver role-based compliance training across credit operations, sales, broker distribution, and customer teams.
Serve as an accessible point of contact for employees raising concerns.
Desired Qualifications
A law degree and post-qualification experience at a firm with a financial services, credit, or securitisation practice.
Experience with warehouse facilities, servicing agreements, or securitisation.
Consumer Data Right or open banking experience as a data holder, accredited data recipient, or intermediary.
Broker-channel or third-party-distribution conduct-risk experience.
Depth in Anti-Money Laundering and Counter-Terrorism Financing, particularly under reformed obligations.
Evidence of specifying software or working closely with engineers.
Mission:
Skip is on a mission to fast-track Australians into homeownership by building a fairer, faster path to buying a home.
We are a fintech lender in a period of rapid growth, with an established risk and compliance framework, an active Risk Committee, and institutional funding relationships that hold us to a high standard. Responsibility for risk, compliance and legal currently sits with our COO.
This role exists to take that framework to its next level of maturity - deeper, more automated, and scalable. It is a genuine build opportunity on a strong baseline, not a caretaker role.
About the role:
This is a role for someone who wants to build – not just manage.
Risk, compliance and legal currently sits with our COO. The framework is in place and functioning: we hold an Australian Credit License, our policies and registers are established, and our partners review us on a regular cycle. What the next stage of growth calls for is a dedicated owner who can continue to uplift our capabilities- deepening the monitoring and assurance program, automating what is still manual, and extending the framework as our volumes, channels and regulatory surface all expand.
We are explicit about the kind of function we want. Risk and compliance should enable growth, not create a queue. In practice, that means you will own the risk appetite so the business can operate inside pre-agreed boundaries without asking permission, publish a service standard for the reviews you own, and be accountable for work going live compliantly rather than for flagging that it might not. It also means you will hold an absolute veto on anything that genuinely threatens our brand and business, and we will back you when you use it. Enabler on ninety-five per cent of decisions; immovable on five.
You will report to the COO with a hard line to the Board Risk Committee. Your objectives are set there, you will have standing time with the Risk Committee, and you will have a documented right to escalate directly to the Board. We have designed the role this way deliberately - genuine second-line independence is what makes the function credible to our Board, partners and our regulators.
You will not be our General Counsel. External counsel handle our securitisation programme and our principal funding agreements and will continue to. You will own the commercial contracting layer around them, and the relationship with those firms.
Over time this role has a clear path. As the business scales it becomes a Chief Risk Officer reporting to the CEO or the Board. If you perform, that opportunity will be on the table.
What this role owns - and what it does not:
Owns. Regulatory compliance, operational and enterprise risk, privacy and Consumer Data Right obligations, and second-line assurance over credit process - whether policy was followed. Plus the commercial contracting layer, the contract register, and the management of external counsel.
Does not own. Credit appetite - whether the policy itself is right - which sits with Credit and Operations. Nor securitisation and funding documentation, contentious matters, or formal legal opinions, which remain with external firms.
Key Responsibilities:
Own and continue to uplift the framework
Own and deepen the compliance obligations register, mapped across the NCCP Act and National Credit Code, the relevant ASIC regulatory guides, the AML/CTF Act, the Privacy Act, the Consumer Data Right regime and our AFCA obligations - and own the process that keeps it current, not just the document that records it
Own the enterprise risk register and lift it to the next standard - named first-line owners, assessed control effectiveness and tracked remediation, reviewed on a rhythm rather than before a board meeting
Own Skip’s risk appetite statement, expressed so that an operations or product lead can tell whether a decision sits inside it without asking you
Design and run a rolling compliance monitoring and testing plan across origination, servicing, collections and hardship
Own the compliance calendar and the policy suite - complaints, breach reporting, AML/CTF, privacy, CDR, hardship, conflicts and outsourcing
Product governance, DDO and target market determinations
Own TMD and DDO review processes and ensure our products align with regulatory requirements
Own the reasonable steps obligation - making sure distribution across our broker, aggregator, white-label and direct channels is consistent with each TMD, and that we can evidence it rather than assert it
Bring market feedback into those reviews as evidence - complaints and AFCA themes, distributor and broker reporting, arrears and hardship experience, and product outcome data - so that a TMD review changes something when the evidence says it should
Sit in the product development process early enough to shape design - not so late that saying no is the only option left
Complaints, AFCA and dispute resolution
Own our internal dispute resolution framework under RG 271, including response timeframes, decision quality and the systemic issues process
Own our AFCA membership obligations and the six-monthly IDR data reporting to ASIC, and use what the data shows us about root causes rather than simply filing it
Own our hardship obligations and the associated regulatory reporting, and make sure the volume of hardship cases informs product and policy rather than sitting in a queue
Breaches and incidents and resilience
Own the incident and breach register end to end, including root cause analysis, remediation tracking and reportable situations assessment under RG 78
Own and mature the operational risk framework - control design and testing, incident themes and emerging risk
Own the outsourcing and third-party register and the risk assessment of material service providers, including their subcontractors
Own business continuity and disaster recovery planning and, more importantly, the evidence it has been tested - and meet the operational risk expectations that flow down to us from our ADI funders
Meet the operational risk expectations that flow down to us from our ADI funders, who assess us as a material service provider
Financial crime, privacy and data
Own Skip’s AML/CTF program - the transition to the reformed obligations, customer due diligence oversight, transaction monitoring and AUSTRAC reporting - and commission the independent evaluation, then close what it finds
Own Skip’s Consumer Data Right position and requirements, including the compliance and reporting relationship with the ACCC and the OAIC, and keep us current with the Consumer Data Standards
Own privacy compliance - the Privacy Act and Australian Privacy Principles, our privacy policy and collection notices, third-party data flows, and eligible data breach assessment and notification
Legal and contracting
Own the contract register, our template agreements, and a contracting playbook that lets the business self-serve on routine agreements
Select, brief and manage external counsel, and own the legal budget
Track conditions subsequent and ongoing obligations arising under our funding and partnership agreements
Escalate anything contentious, novel, or bearing on our funding structure to external counsel - and know exactly where that line sits
Governance and reporting
Own the Risk Committee pack and the risk section of board reporting - material risks, emerging themes, control weaknesses and overdue remediation, said plainly
Support the operation of the Risk Committee, including action registers tracked through to completion
Be our point of contact for funder, rating agency and auditor due diligence on the risk and compliance framework
Ways of working
We do not accept compliance processes that scale linearly with volume. You will have the full support of our product and engineering team, and we expect you to use it
Push policy checks into the origination flow rather than onto a checklist, build automated exception and breach detection, and design the function so compliance headcount grows sub-linearly with settlements
Design and deliver role-based compliance training across credit operations, sales, broker distribution and customer teams - and be the accessible, trusted point of contact for anyone raising a concern
What you will bring:
8+ years across risk, compliance or financial services regulation, including time inside an Australian credit licensee. You have personally owned a compliance and risk framework - owned it, not advised on it
Working knowledge of the NCCP Act and National Credit Code, the relevant ASIC regulatory guides, the AML/CTF Act and the Privacy Act as they apply to a credit provider
You have worked in a business under about 150 people. You know a framework designed for a bank does not transplant, and that adding process is usually the wrong answer
Experience identifying, assessing and monitoring operational risks and controls - registers, incidents, remediation, emerging risk - and translating obligations into controls people will actually follow
Commercial judgment. You can tell the difference between a risk that threatens the licence and a risk that is merely untidy, and you treat them differently
A collaborative, pragmatic style - able to build trust with frontline, sales and product teams without diluting the independence of the second line
Excellent written communication. You can write a board paper a director reads once and understands
Helpful, not required
A law degree and post-qualification experience at a firm with a financial services, credit or securitisation practice.
We are not hiring a General Counsel, but this role manages our commercial contracting and our external counsel, and a legal background makes that materially easier. It is a strong plus, not a filter - we would take a compliance operator who has built a framework over a lawyer who has not
Experience with warehouse facilities, servicing agreements or securitisation
Consumer Data Right or open banking experience - as a data holder, an accredited data recipient, or through an intermediary arrangement
Broker channel or third-party distribution conduct risk
AML/CTF depth, particularly under the reformed obligations
Evidence you have specified software or worked closely with engineers
Why join us:
Build, don’t babysit. You inherit a functioning framework and a credible baseline - and the mandate to take it from solid to best-in-class. Real ownership from day one, not a delegated slice of someone else’s job
Real independence. A hard line to the Risk Committee, your objectives set there and a documented right of escalation to the Board
A clear path up. As the business scales this becomes a CRO role reporting to the CEO or the Board. If you perform, that will be explicitly on the table
Engineering leverage. Full support of an internal product and engineering team, so you automate the function rather than staff it
Serious company, serious scale. Backed by leading US venture funds, global credit partners and prominent Australian investors, Skip is in a true hyper-growth phase with major distribution partnerships already live
A positive impact. Your work helps hard working Australians Skip to home ownership sooner
A team that backs you. We move fast, we take ownership, and we back each other to do the best work of our careers