Business Risk Analyst (Fraud & Trading)

About The Company

Hercle is a fast-growing fintech building institutional‑grade infrastructure that bridges fiat, stablecoins, and digital assets, enabling cross‑border transactions at scale and in real time.

Serving over 200 clients globally, Hercle provides banks, brokers, payment service providers, and fintechs with seamless solutions for cross‑border payments, trading, and treasury management.

About The Role

In this role, you will serve as a Business Risk Analyst within the first line of defence (1LoD), supporting the day‑to‑day risk operations of Hercle. The primary objective is to assist the Head of Operations in managing the 1LoD non‑financial risk framework across two core domains: (A) payment fraud monitoring and (B) market abuse & trade surveillance. The Analyst has operational ownership of the front‑line alert queues, conducting L1 investigations, managing case lifecycles, and escalating confirmed or material findings through established governance channels to the Risk Management and Compliance function. The role demands the ability to exercise sound, evidence‑based judgment under time pressure across multi‑currency fiat flows, stablecoin movements, and trading activity on regulated venues.

Key Responsibilities

Payment Fraud Monitoring (escalation line: CRO)

• Operate the daily fraud monitoring workflow on the firm’s payment monitoring platform (Flagright or equivalent), covering inbound and outbound fiat flows and digital asset transfers across Hercle’s accounts.
• Triage real‑time fraud alerts: classify, investigate, and document each case in the case management system in accordance with internal policies.
• Execute L1 controls on payment exceptions, including APP fraud red flags, unauthorised transactions, mule‑account patterns, account‑takeover indicators, social‑engineering typologies, and merchant/PSP‑side anomalies.
• Coordinate with the AML team on overlapping financial crime red flags — suspicious activity, structuring, and sanctions — maintaining a clean separation between fraud cases and AML/STR cases.
• Escalate confirmed fraud, material near‑misses, and policy exceptions to the Chief Risk Officer per the escalation matrix; prepare incident packs and contribute to root‑cause analysis.
• Maintain fraud KRIs (alert volumes, false‑positive rates, fraud losses, recovery rates, and SLA adherence) and contribute to the monthly 1LoD risk reporting cycle.
• Support the calibration of fraud detection rules, thresholds, and scenarios in coordination with the CRO and the technology owners of the monitoring platform.
• Liaise with banking partners and PSP counterparties on disputed transactions and recall requests.

Market Abuse & Trade Surveillance (escalation line: Local Compliance Officer)

• Operate the L1 trade surveillance workflow defined by internal policies, covering the firm’s trading activity across all in‑scope typologies (e.g. spoofing).
• Review and manage trade surveillance alerts; document rationale, supporting evidence, and case disposition in the case management system.
• Investigate cross‑venue, cross‑asset, and cross‑account patterns; request and analyse order book data, trade logs, and counterparty information as required.
• Escalate suspicious patterns and candidate cases to the Compliance Department in accordance with the firm’s escalation matrix; prepare investigation files to support Compliance’s L2 review.
• Contribute to scenario calibration, threshold tuning, and the periodic effectiveness review of trade surveillance coverage.
• Maintain market abuse KRIs and contribute to the monthly 1LoD risk reporting cycle.

General Responsibilities

• Contribute to the maintenance and ongoing development of 1LoD procedures, control narratives, and operating manuals.
• Support RCSA activities led by 2LoD, providing evidence on the design and operating effectiveness of business‑line controls.
• Participate in DORA‑aligned incident management drills and operational resilience testing where relevant to the fraud and market abuse domains.
• Act as subject‑matter contact for internal audit, external audit, and regulatory engagements on fraud and surveillance topics.

Requirements

• Minimum two years of professional experience in a first‑ or second‑line risk, fraud, or surveillance role within a fast‑paced financial services environment: investment bank, systemically important financial institution, payment service provider, electronic money institution, fintech, or asset manager.
• Bachelor's degree in Economics, Finance, Banking, Statistics, Engineering, or a related quantitative discipline.
• Demonstrated ability to manage alert queues under SLA pressure and produce defensible, evidence‑based case files.
• Working knowledge of at least one of the following: PSD2 fraud requirements (SCA, transaction risk analysis, and fraud reporting under EBA RTS); MAR Articles (market abuse typologies and STOR mechanics); or a recognised equivalent framework.
• Strong analytical skills, including proficiency in SQL or a comparable data query language, with demonstrated comfort working with structured transaction and trade data.
• Professional fluency in English and Italian.
• Sound judgment, intellectual honesty, and a proven willingness to escape without hesitation.

Preferred Qualifications

• Direct hands‑on experience with Flagright or a comparable transaction monitoring or fraud platform (e.g. Hawk AI, Feedzai, ComplyAdvantage).
• Hands‑on experience with trade surveillance platforms (e.g. Solidus Labs, Eventus Validus, NICE Actimize, Trillium Surveyor).
• Understanding of global market microstructure, venue ecosystems, and the payments industry across its principal sub‑segments (acquiring, issuing, money remittance, e‑money, account‑to‑account, and card scheme rails).
• Familiarity with crypto‑asset markets, stablecoin flows, on‑chain analytics, and the market abuse regime under MiCAR.

Compensation

• Base salary in the range of €35,000 – €45,000 per annum, commensurate with experience.

Why Join Hercle?

This isn't a role where you'll spend your days rubber‑stamping alerts in a queue someone else built. You'll be standing up the first‑line risk function of a company operating across multiple jurisdictions, asset classes, and regulatory regimes — and the controls you design and operate will matter from day one.

You'll work directly with the CRO and Compliance, close to real trading and payment activity, with genuine ownership over the fraud and surveillance frameworks as they scale. If you want to move beyond checkbox compliance and actually build something, this is where you do it.