Financial crime risk and GRC are both being rebuilt on AI, and converging with model risk. Most banks are still hiring for the world that’s ending. Here’s the 2026 hiring map.
Two of the most important functions in any bank, financial crime risk management (FCRM) and governance, risk & compliance (GRC), are being rewritten by the same forces. Both are absorbing AI as a primary tool, both face sharper regulatory expectations, and both are converging with model risk and data engineering.
Together they create hiring needs most banks haven’t recognized, because most banks are still hiring for the world that’s ending.
Three roles surging in demand and badly undersupplied.
What they doBuild and maintain the graph-ML infrastructure behind modern FCRM, speaking both ML engineering and the regulatory language of typologies, OFAC, and SAR filing.
Why undersuppliedMost graph-ML talent built its career in fraud, recommendations, or social networks at tech firms; translating into a regulated bank takes about a year of context most banks don’t have runway for.
Where to find themEx-fintech engineers from firms like Plaid, Chainalysis, or Feedzai, or grown internally from data engineering on a clear two-year ramp.
What they doBuild the automated test infrastructure that replaces annual control testing: controls written in code, run continuously, producing the evidence streams audit and regulators consume.
Why undersuppliedThe role barely existed three years ago. The pool is assembled from internal audit (process) and DevOps (engineering), an uncommon combination where one-sided hires end up weak on the other.
Where to find themProgressive internal-audit teams already doing data-driven testing, or DevOps engineers from regulated SaaS who’ve learned the language of controls.
What they doOwn the combined GRC + model-risk function for AI systems: the regulator-facing voice on AI governance, coordinating across model risk, controls, and the first-line business.
Why undersuppliedNeeds senior risk/compliance credibility (10+ years) plus genuine AI fluency. Most candidates have only one. The ones who work invested in AI literacy over the last 24 months, and aren’t on job boards.
Where to find themAsk your competitor’s CRO who they’re most worried about losing. That’s the candidate.
Three roles quietly being eliminated as the platforms they support get retired.
If the hiring implication fits in one sentence, it’s this: the next generation of BFSI risk leaders need to be bilingual in regulator and engineer. The first language is learned through years inside the function; the second is harder to acquire mid-career, which is exactly why the candidates who’ve invested in it are the most valuable hires in the industry.
The kind of writing on workforce, AI, and enterprise hiring you'd actually want to read on a Sunday morning. No vendor pitches, no ad copy, no fluff.