Group Control Assurance Lead

Company Mission

Payhawk is one AI-powered spend management platform for scaling businesses — corporate cards, expense management, procurement, and accounts payable, unified in one place. We serve finance teams across 32+ countries, cutting month-end close time and reconciling 99.7% of transactions with zero manual touch. AI runs through the platform as core infrastructure, not a bolted-on feature — and we hire the top 1% of talent in every function to keep building it that way.

Why Payhawk
Payhawk, where the bold builders make an impact.

We're not a family, we're a high-performance team — and that's deliberate. We debate, ideate, and push each other to be better, because the best ideas come from direct feedback. We've already made history as Bulgaria's first unicorn, but the ambition doesn't stop there: if you want to grow fast - own it; do not wait for it.

Give : Honest opinions, real ownership, a focus on outcomes.
Get : A front-row seat to a market leader in one of the fastest-moving industries.

The role, in one line

You will independently test whether the controls across Payhawk's two e-money institutions, in the UK and Lithuania, actually work, and drive the gaps you find through to closure.

What you will own

• Build and own the Board-approved group control assurance and monitoring plan for both licensed entities, with priorities set by the risk assessment and agreed with the Risk Committee.
• Design and run risk-based control testing across the group risk register, assessing both design effectiveness and operating effectiveness.
• Test operational resilience and ICT controls under the Digital Operational Resilience Act, and governance and conduct controls across both entities.
• Test safeguarding and capital adequacy controls, including whether reconciliations and calculations evidence what they are relied on to evidence.
• Test regulatory reporting controls, including whether the data behind each regulatory return is complete and accurate.
• Test outsourcing and third-party controls, including whether we would detect a critical provider falling below its obligations.
• Test detection controls independently and end to end. This covers sanctions and politically exposed person screening effectiveness, and transaction monitoring coverage and calibration, including the population that never generated an alert.
• Lead the remediation of the gaps you identify as programme manager for closure. You will convene the relevant stakeholders, agree scope, owners and dates, track progress, escalate where work stalls, and secure the governance approvals required.
• Validate independently that a remediated control works before the finding is closed, and reopen it where the fix does not hold.
• Provide credible challenge to control owners, with written findings, severity ratings, agreed actions, and owners.
• Report testing results, remediation status, coverage against plan, and thematic findings to the Risk Committee and to the Boards of both entities.
• Own the relationship with external assurance providers, and progressively bring recurring testing in-house to reduce cost and dependency.
• Build testing as tooling: automated, repeatable, population-level tests that generate their own evidence, rather than one-off manual exercises.
• Support supervisory engagement and internal audit by producing evidence of control effectiveness on demand.
• Provide independent assurance over significant change, so new systems and processes are tested before they become business as usual.

What you will need

Must-have

• Genuine fluency with AI in your day-to-day work. You can pull your own data and reports from connected systems, prompt well enough to get reliable answers from large document sets and datasets, and chain a few steps into a repeatable workflow.
• Something you have built yourself, such as a workflow, a set of prompts, a report, or a small automation that saved you real time, which you can walk us through.
• Compliance monitoring, control testing, or assurance experience across a regulated framework, in a second-line or third-line capacity. This experience should cover more than one risk domain rather than a single specialism.
• Strong knowledge of Financial Conduct Authority expectations on the compliance function and its monitoring programme, and of equivalent EEA expectations.
• Real depth in at least two of the risk domains above, and the appetite to build depth in the others.
• The ability to distinguish control design from control execution, and to test a system rather than a case file.
• A track record of driving remediation to closure, not only reporting findings.
• The ability to run a programme without owning the resources. That means convening stakeholders across functions, holding them to dates, escalating proportionately, and getting decisions made.
• Comfort working with data at population level rather than relying only on manual samples, and the ability to get to an answer in a dataset with the tooling available to you.
• Independence and spine. You can tell a senior control owner that their control does not work, evidence it, and make the finding stick.
• Written English to Board standard.
• The judgement to rate findings proportionately rather than escalating everything.
• Fluent written and spoken English.
• The right to work in the United Kingdom.

Nice-to-have

• A Big Four or specialist consultancy background in assurance, audit, or regulatory advisory.
• Experience in a payments, e-money, or banking institution, and familiarity with how these frameworks apply to an electronic money institution.
• Testing exposure to operational resilience and ICT risk, safeguarding, capital adequacy, or regulatory reporting.
• Experience testing screening or transaction monitoring effectiveness, including matching behaviour, list coverage, and scenario back-testing.
• SQL, Python, or similar, and practical use of data testing frameworks.
• A relevant qualification, such as IIA, ICA, ACAMS, or equivalent.
• Experience of a multi-entity or multi-jurisdiction group structure, and of intragroup outsourcing oversight.

What you will get

• Recharge properly — 30 days of paid holiday
• Change the view — a week-long exchange to London, Amsterdam, Paris, Munich, Vilnius, Berlin, Sofia, or Barcelona
• Win together, celebrate together — regular team-wide events that are actually worth showing up to
• Covered, properly — additional medical care
• Stay in the game — a sports card, fully funded, for the gym, classes, or your sport of choice
• Commute easily — a monthly travel allowance that covers getting to and from the office
• Use what you build — hands-on access to the actual product you're hiring people to help build

Payhawk is an Equal Employment Opportunity Employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, or disability status.