Director of Fraud and Underwriting

SimplePractice is headquartered in Los Angeles, California, but we have team members who work and live across the United States, Dominican Republic, Mexico City, and Ukraine.

At SimplePractice, we are improving access to quality care by equipping health and wellness clinicians with all the tools they need to thrive in private practice.

More than 250,000 providers trust SimplePractice to build their business through our industry-leading software with powerful tools that simplify every part of practice management. From admin work to clinical care, our suite of innovative solutions work together to reduce administrative burden-empowering solo and small group practitioners to thrive alongside their clients.

Award-winning and people-first, SimplePractice is shaping the future of health tech. In 2026, we were recognized by BuiltIn as a Best Remote Company to Work For, Software Guru's Best Places to Code, Becker Healthcare Telehealth Companies to Know, and we won a MedTech Breakthrough Award for Best Practice Management Solution Provider.

You will manage the end-to-end operating model for fraud, payments underwriting, and platform abuse across the full customer lifecycle: pre-onboarding and KYB/KYC, payments underwriting and approval decisioning, transaction and payout monitoring, bank-change and account-takeover controls, disputes and chargeback strategy, reserves and holds, spam and platform abuse containment, and account decisions across approval, holds, re-enablement, termination, and deletion. You'll report to the Chief Legal Officer and work in close partnership with our CISO and Product/Engineering leadership. This is a strategy and program-ownership role: you'll set direction and represent our fraud posture to the executive team, while a team of analysts and leads runs the day-to-day operations you design.

Strategy and risk appetite

• 
  

  Own SimplePractice's fraud and payments risk appetite - loss tolerance in basis points of payment volume, acceptable false-positive and review rates, review and verification requirements, approval-rate targets by segment. You propose it, you drive executive alignment on the tradeoffs those numbers encode, and you are the decision-maker on policy changes within it.

  
  
• Build the roadmap for the function across policy, data, tooling, modeling, automation, and org design. Sequence it so early wins fund later investment.
• Move policy from documented practice to governed artifact: versioned rules and thresholds, backtested before deployment, shadow-run or champion/challenger tested where exposure warrants it, with an auditable decision trail showing which policy version and which signals drove any given outcome.
• Set the standard for how emerging attack patterns get from first detection to deployed control, and shrink that cycle time deliberately.

Underwriting and onboarding risk

• Own payments underwriting and KYB/KYC decisioning end to end - policy, thresholds, data sources, verification requirements, escalation paths, and the conversion-versus-risk tradeoff at each gate.
• Build risk-tiered onboarding: automated approval for the clean majority, proportionate friction for the ambiguous middle, real scrutiny reserved for genuine signal.
• Own reserves, holds, and payout-timing policy as credit and exposure decisions, not just fraud decisions. Size them at portfolio level with a defensible methodology.
• Maintain card network and ACH program compliance - Visa VAMP, Mastercard ECP, Nacha return-rate thresholds - and keep us well inside them, including the Nacha fraud-monitoring obligations that reached all originators in 2026.

Fraud operations and detection

• Run fraud operations to explicit SLAs on throughput, accuracy, and time-to-contain, with capacity modeling and workforce planning rather than reactive hiring.
• Drive automation and AI-assisted triage into the review pipeline to reduce manual touch volume, and hold yourself to a measurable cost-per-decision trend, not just a loss number.
• Own the risk policy and configuration layer of the detection stack - rules, scoring thresholds, identity and device signals, case management, queue design - under a shared administration model with Product and Engineering, who own the underlying platform. Define the boundary clearly and make it work.
• Own vendor strategy for the risk stack. Evaluate, select, and manage vendors against measured ROI, and be willing to consolidate or cut.
• Partner with data science to build, validate, monitor, and retrain fraud models. You don't need to build them, but you need to know when one has drifted and be able to say why.

Platform abuse and account integrity

• Co-own spam, scaled signup abuse, and platform-abuse controls, in partnership with Security, Product, Engineering, and Marketing.
• Co-own account-compromise and account-takeover response with Security, with clear boundaries on who leads what.
• Build controls for the current threat set: synthetic and stolen identity at onboarding, injection and deepfake attacks against identity verification, agentic and automated account takeover, first-party misuse where identity verifies cleanly and intent is the only signal, and payout redirection through bank-detail changes.

Influencing product and engineering

• Establish a pre-launch risk review for anything that touches money movement, identity, account access, or payout - with fraud threat modeling done at design time, not launch week. Make it fast enough that teams want to use it rather than route around it.
• Monitor shipped and in-flight product for builds that open new fraud surface, and raise them with enough specificity and evidence that they get fixed.
• Translate risk needs into product and engineering requirements a team can actually build against: data and signal gaps, instrumentation, decisioning hooks, internal tooling for investigators, reason-code plumbing, latency budgets. Bring requirements, not complaints.
• Earn standing roadmap influence. Build the case with loss data, exposure modeling, and customer-friction evidence, and get fixes prioritized against competing work - without formal authority over those teams.
• Partner with Compliance, Legal, Security, Support, and Finance on the pieces they own, and be explicit about the seams.

Enabling the rest of the company

• Own the escalation paths, SOPs, and training that let Support, Success, and Sales handle fraud-adjacent situations correctly without routing everything to your team.
• Maintain the knowledge base and QA standards that keep decisions consistent as the team grows.

Incident command and reporting

• Serve as domain lead for financial-fraud incidents: lead the response, make containment and account-action calls, coordinate cross-functionally, document incidents, and run honest postmortems that produce hardening work items.
• Own the fraud metrics package to executives: loss rate in basis points of payment volume, chargeback and dispute performance, approval and decline rates, false-positive and review rates, time-to-detect and time-to-contain, recovery, and operational SLA adherence. Frame tradeoffs, not just results.
• Represent fraud risk in executive forums, and with payment partners, sponsor banks, and networks alongside the accountable executive.

Team

• Lead, coach, and grow the Fraud, Risk & Underwriting team, including senior individual contributors.
• Design the org for where we're going: differentiate strategy and analytics work from operational disposition, and build the analytical capability the function currently lacks.
• Set a high hiring bar and develop people into the next tier of leadership.

• 10+ years in fraud, payments risk, underwriting, or financial crime, including 5+ years leading teams - with real experience managing managers.
• Direct experience at a payment facilitator, PSP, acquirer, marketplace, fintech, or embedded-payments platform. You understand merchant-of-record liability, sub-merchant underwriting, reserves, and card network and ACH compliance programs from the inside.
• A track record of building a function, not just running one: you have taken a fraud or risk team from operational and reactive to systematic and scaled, and can describe what you built, in what order, and what it moved.
• Fluency across multiple risk surfaces - card-not-present payments, ACH and money movement, identity and onboarding, account takeover, disputes - and the judgment to tailor controls to each rather than applying one playbook.
• Demonstrated ability to influence product and engineering roadmaps without owning them. You can point to fraud controls that shipped because you made the case.
• You have defended a decision that traded approval rate against loss rate, and can walk through the total-cost math - including revenue lost to false declines - rather than optimizing for the lowest gross loss number.
• You have presented fraud loss and risk tradeoffs directly to a C-level or board audience, and can turn a technical fraud trend into a specific ask.

• Technical acumen sufficient to be a credible partner to engineering and data science: you understand how a decisioning system is put together - signals, features, rules, models, latency constraints, logging - and can write requirements at that level.
• Hands-on data fluency. You query the data yourself in SQL rather than waiting on a dashboard, and you validate your own hypotheses.
• Practical experience with the modern risk stack - decisioning and orchestration platforms, rules engines, case management, identity verification and KYB providers, device and behavioral intelligence - including vendor selection and integration.
• Working literacy in model risk practice: validation, monitoring, drift, champion/challenger testing, and why the audit trail matters.
• Experience operating risk controls under HIPAA, PHI-adjacent, or comparable regulatory constraints.
• CFE, CAMS, or CFCS.

We offer a competitive benefits program including:

• Medical, dental, vision, life & disability insurance
• 401(k) plan with company match
• Flexible Time Off (FTO), wellbeing days, paid holidays, and summer Fridays
• Mental health resources
• Paid parental leave & Backup Care
• Tuition reimbursement
• Employee Resource Groups (ERGs)

Thank you for your interest in opportunities at SimplePractice LLC ("SimplePractice" or "us" or "we" or "our"). Please note that when you submit your resume or application materials to us for employment purposes, you are subject to the SimplePractice California Job Applicant Privacy Notice.

For more information about our privacy practices, please contact us at privacy@simplepractice.com.

SimplePractice has been made aware of fraudulent job postings and unaffiliated third parties posing as our recruiting team. We do not have any affiliation or connection to these situations and only post open roles on our official Careers page (simplepractice.com/careers) and reputable job boards like our official LinkedIn or Indeed pages.

All official SimplePractice recruitment emails will be sent from the domains @simplepractice.com, no-reply@greenhouse.io or noreply@linkedin.com email addresses.

Examples of fraudulent domains include careers-simplepractice.com, simplepractices.com, and simplepractice.careers.

Please note that SimplePractice will never ask candidates or new hires for money or payment of any kind at any stage of the recruitment or onboarding process.