Fintech Fraud-Cyber Fusion Leader — Real-Time Lending

The mandate

Attackers combined credential theft, device manipulation and rapid loan drawdown while fraud and SOC teams closed partial signals separately. They shifted accounts between devices, used mule beneficiaries and exploited customer-support recovery to keep each individual event below escalation thresholds. The fraud chief left after customer losses and complaint handling exposed the fragmented decision model and inconsistent ownership of vulnerable-customer cases.

The interim begins within two weeks for ten months across São Paulo and Rio, initially chairing daily campaign decisions before moving to a twice-weekly fusion rhythm. Permanent recruitment starts after two stable loss cycles and independently reviewed intervention performance; five weeks of overlap follow, with extension possible only when the selected successor's availability crosses the planned transfer.

Handover requires fused signals, governed real-time interventions, reconciled fraud and cyber cases, improved loss and false-decline thresholds, tested customer recovery and a successor-led conduct review. Model and rule changes must retain reason codes, affected-population analysis and rollback, while three coordinated campaigns must show end-to-end ownership from detection through funds containment and redress.

The leader may block journeys, change detection thresholds, redirect teams and commission specialist support within the approved BRL 18 million envelope. The role may suspend a partner or recovery flow when abuse evidence is material. Credit appetite, permanent hiring, customer redress policy, law-enforcement referral and public attribution require authorised executive approval.

Collections, underwriting redesign and enterprise infrastructure security are excluded. Those functions provide data and execute approved controls but retain their business mandates. The seat owns account-takeover and digital-abuse decisions across formerly separate teams, not the lender's wider credit-loss or customer-service transformation.

Why this seat is open

The coordinated campaign exploited organisational seams rather than one missing rule. Prior leadership could not arbitrate fraud loss and cyber evidence. Temporary command must restore customer protection and durable joint ownership.

What you will own

• Reconstruct attacker, device, identity, beneficiary, transaction and customer-contact journeys across fragmented cases, preserving event time and confidence.
• Fuse endpoint, identity and network telemetry with behavioural, payment, mule, complaint and fraud-case evidence into campaign-level decisions.
• Decide intervention thresholds across silent monitoring, step-up, payment hold, account block and investigation using customer and conduct impact.
• Measure prevented and realised loss, false decline, abandonment, vulnerable-customer harm and attacker displacement together for every material intervention.
• Establish joint case ownership and rapid escalation for coordinated campaigns, with one accountable lead from detection through customer recovery.
• Exercise recovery from compromised identity through credential reset, beneficiary containment, funds tracing, customer contact and consistent redress referral.
• Transfer rule rationale, model limitations, campaign histories, exception decisions and conduct governance through two successor-led operating cycles.

Candidate qualifications

• Held executive fraud-cyber authority in real-time fintech or banking with direct conduct, loss and vulnerable-customer accountability.
• Led response to coordinated account takeover and transaction abuse spanning identity recovery, mule beneficiaries and rapid funds movement.
• Can evidence fused cyber, device, behavioural and payment signals that materially changed intervention precision or campaign discovery.
• Balanced loss prevention, false decline, customer recovery and vulnerable-customer harm using measured outcomes rather than model accuracy alone.
• Governed data science, investigations, SOC, payment operations and customer teams through a single campaign decision framework.
• Handed stable fusion operations, model limitations and live campaign ownership to permanent leadership after repeated control cycles.

Non-negotiables

• Available within two weeks for the Brazilian cadence.
• Independent of fraud-platform and identity vendors involved.
• Will challenge growth when customer-protection evidence fails.
• Has director or CRO-1 decision rights in live digital fraud.

1. 49 words maximum. State your availability and one fused fraud-cyber campaign you stopped.
2. 49 words maximum. Which paired signals revealed abuse that separate queues missed?
3. 49 words maximum. Describe an intervention threshold you changed to reduce customer harm.