Compliance Analyst/Manager, Issue Management

We're looking for a compliance professional to own issue management end to end: the inventory of known compliance issues across our card programs, the corrective action plans that resolve them, the consumer remediation that makes affected customers whole, and the reporting that tells our bank partners exactly where each issue stands.

This is the role that decides whether a problem is actually fixed. Not fixed on a ticket, not fixed in a status update, but fixed in the product, validated with evidence, and closed with a record that holds up when an examiner reads it two years later.

Cardless is a program manager that partners with FDIC- and OCC-regulated issuing banks to design and deliver co-branded credit and debit card programs. Our compliance team operates within this bank partnership model, which means every issue you work has to satisfy us, a brand partner, and an issuing bank with its own regulator, issue management guidance, numbering conventions, and reporting cadence. Understanding the program manager structure is key to succeeding in this role.

• →

  Own the compliance issue log end to end: intake, classification, root cause, target dates, status, and closure, across every card program and bank partner.

• →

  Log newly identified issues with the facts that matter: what broke, which regulation or requirement it touches, when it started, when consumer harm stopped, and how many customers are affected.

• →

  Keep the log reconciled to each bank partner's own issue register, one for one, so the two records never tell different stories.

• →

  Maintain a dated chronology for each issue at a granular level. Examiners ask what happened, when, who knew, and when it reached a compliance committee. The answer needs to already exist.

• →

  Reassess aged issues honestly and negotiate achievable remediation timelines with the bank rather than letting dates quietly slip.

You are the person who reads "fixed, deployed" and asks to see the list. Wherever you have worked, you have been the one who checked, found the thing nobody had noticed, and said so. You are precise about numbers because you have been burned by an imprecise one, and you would rather be told your analysis missed a segment than be agreed with.

You write clearly and you write fast, because this job is mostly writing under a deadline, and what you write gets read by people whose job is to find the gap in it. You are organized enough to hold dozens of open items with hard dates and not lose one.

You are already working with AI, not curious about it in the abstract. You know where it is strong, you check it where it is weak, and you would rather build the thing that does the task twice than do the task twice.

You are comfortable with a blank page and you see it as something to build. You do not need to have done compliance before, but you want to learn why a rule exists rather than just what it says. And you are energized, not unsettled, by a program manager model where the same issue has to satisfy us, a brand partner, and an issuing bank with its own regulator.

• Write corrective action plans that name the defect, the fix, the owner, the target date, and the evidence that will prove it worked.

• Establish and document the date ongoing consumer harm stopped for every consumer-impacting issue, and push for an interim control when the permanent fix is months away.

• Work with Engineering, Product, and Operations to get the underlying defect fixed, and distinguish a durable fix from a point patch that will resurface as a repeat finding.

• Test the fix yourself, or make sure someone did, before you call an issue remediated.

• Escalate early and in writing when a remediation date is going to be missed, or when a previously closed issue comes back.

• Scope impacted populations by sub-issue, including the overlaps, so there is a full picture of who needs which kind of remediation.

• Design the remediation: what each affected population is owed, how it gets delivered, and how customers who are closed, charged off, or otherwise hard to reach are handled rather than quietly dropped.

• Verify after the fact that every customer received the amount they were supposed to receive, and build the audit trail that proves it.

• Partner with Finance and Operations on payment execution, and own the reconciliation when the numbers do not match.

• Produce the monthly issue log for each bank partner on a fixed date, with accurate status on every open item.

• Adopt and operate to each bank partner's issue management guidance, and adapt to differing expectations across partners.

• Respond to bank partner and examination requests on open issues, including remediation status, populations, and evidence, on short turnarounds.

• Prepare issue management reporting for the Compliance Committee and the Board.

• Improve the tooling and workflow behind issue management, including automation, so the program scales faster than headcount.

• Turn recurring issue patterns into preventive controls and monitoring, so the same defect class does not come back.

• Keep issue records organized, complete, and examination ready at all times, not assembled in a scramble when a request arrives.

• Provide coverage across other compliance functions, as needed.

In your first 90 days, you own the issue log. You know every open issue, its status, its owner, and its target date without looking it up. You have learned our programs, products, and partners well enough to scope a population without a chaperone. The log reconciles to each bank partner's register, the monthly reporting goes out on its committed date, and every consumer-impacting issue has a documented date that harm stopped.

By six months, you own a functioning issue management program: consistent intake and classification, corrective action plans with real evidence standards, remediation that is scoped by sub-issue and verified after payment, and reporting that bank partners recognize as an improvement. You have taken a meaningful share of the open inventory to validated closure, and the issues you closed have stayed closed. Recurring defect classes now have monitoring in front of them, so the next one gets caught by a control instead of by a customer. Issue management has gone from the thing we scramble on before a bank call into the program the rest of compliance is measured by.