Risk Control Analyst - ATO & Risk Strategy

About the Role: We are seeking a Risk Control Analyst to own Account Takeover (ATO) risk strategy end to end. This role works closely with business owners, product, security, and risk engineering to design, deploy, and continuously tune risk controls across login, device, transaction, and account-change surfaces, and to stay ahead of evolving account-takeover attack patterns.

What You’ll Do:

ATO Strategy Design & Deployment

• Design and deploy ATO risk control strategies: risk analysis, feature extraction, rule and strategy deployment, and control-flow design
• Define step-up and intervention logic — challenge, block, restrain, or add friction — balancing loss prevention against user experience
• Design end-to-end control flows across login, device, transaction, and account-change scenarios, including fallback and exception handling
• Translate emerging attack patterns and threat intelligence into actionable detection rules and mitigation measures

Detection & Signal Engineering

• Build and refine ATO detection pipelines using device, IP, behavioral, and biometric signals
• Construct multi-layered defense chains so that a single signal failure does not create a control gap
• Specify signal and data requirements to data and engineering teams; validate coverage and data quality in production

Strategy Effectiveness & Optimization

• Own strategy performance end to end: define success metrics (detection rate, loss prevented, false-positive rate, challenge pass rate) and track them on an ongoing basis
• Run A/B, shadow, or backtest evaluations before and after rollout; quantify impact on both fraud loss and good-user friction
• Continuously tune thresholds and logic to reduce false positives without eroding detection coverage

Cross-team Execution

• Work with data and engineering teams to productionize rules and models, and to resolve deployment and data issues
• Partner with product, security, and compliance teams on end-to-end risk flows, control requirements, and incident response
• Lead post-incident reviews on confirmed ATO cases and feed findings back into strategy
• Document risk control designs, decision rationale, and review outcomes

What We’re Looking For:

• 3+ years of experience in risk control, fraud prevention, or a related analytical role
• Hands-on experience designing and deploying risk rules or strategies in a real-time production environment — not investigation or case handling only
• Direct experience in account security, ATO, or identity risk; adjacent fraud-domain experience with clearly transferable detection work is acceptable
• Strong analytical skills: ability to extract risk features from data, build detection logic, and measure control effectiveness
• Solid understanding of risk control frameworks — rule-based decision systems, scoring models, and layered defense design
• Proficiency in SQL and data analysis tools; comfortable working with large datasets
• Strong communication and stakeholder management skills — able to translate business needs into risk control requirements and drive cross-team execution
• Experience using AI tools in day-to-day work, e.g. using AI to analyze risk issues, automate and optimize rules, screen data, or accelerate investigation workflows

Nice to Haves:

• Experience with device fingerprinting, behavioral analytics, or biometric verification signals
• Experience working with third-party risk vendors (face verification, device intelligence, fraud scoring)