OnHires - Internal Auditor

• 5+ years of internal audit or internal control experience in a regulated financial services entity - bank, payment institution, EMI, investment firm, insurer, regulated fintech or crypto/VASP. Unregulated-only experience will not be considered. • Hands-on audit experience with at least one fintech, payment institution, EMI, crypto exchange or VASP - execution, not advisory theory. • Working knowledge of at least two of MiCA, PSD2, AMLD5/6 and DORA, with the ability to turn a regulatory obligation into a test programme. • Strong understanding of AML/KYC/CTF frameworks and how to audit their effectiveness. • Evidence of independence in practice - critical findings delivered to senior management or a Board and held under challenge. • Ability to run an engagement unsupervised and to make and defend a professional judgement on control severity. • Sufficient ICT and information security audit literacy to scope a DORA engagement and to direct and challenge an external technical specialist. • Fluent professional English - reports go to the Board and to the regulator as written. • Hands-on use of AI tools in audit work - planning, analysis, testing or reporting - with concrete examples. • Right to work and tax residence in the EU/EEA, with eligibility to be appointed to an internal control function of a licensed entity. • MiCA CASP post-authorisation audit experience. • PSD2 / EMI safeguarding, own funds and scheme-compliance audit experience. • Deep ICT / information security audit capability, including DLT infrastructure, wallet security and key management. • DORA operational resilience, outsourcing and third-party risk audit experience. • Custody and segregation-of-client-assets audit experience. • Travel rule (FATF / EU TFR) audit experience. • Experience with a Baltic or other EU financial supervisor. • Board- or regulator-facing communication experience. • CIA, CISA, ACCA or an EU-recognised internal audit qualification. • Russian or Latvian. • What Makes This Role Different • This role is for auditors who want real independence, not a compliance review with an audit title. • You inherit a working function - Charter, plan, universe, and findings register already exist and are Board-approved - and you run it, not rebuild it from scratch. • You report functionally to the Board, set your own severity ratings, and deliver findings directly to the people who can act on them, including senior leadership. • You'll work across one of the more complex dual-licensed perimeters in Europe (MiCA CASP + PSD2 PI), with direct Board access and budget for external technical specialists where needed. • Working Environment • Remote across the EU/EEA, with periodic in-person days at the company's EU office (roughly quarterly, or around Board meetings). • Part-time engagement (~0.5 FTE), B2B consultancy contract. • Functional reporting to the Management Board; no team, no review layer - full ownership of the function. • Scheduled checkpoints at scope memo, draft report and Board reporting stages; no involvement from management in fieldwork, findings or ratings.