Remote Risk Management Jobs: Pay, Specialties, Reality

Last reviewed: September 2026

You spend your week telling the business which exposures it can survive and which one will end it. You write the memo nobody reads until the quarter it matters. Then you open a job board, type "remote risk management," and get back a thousand results that mostly are not remote.

Look at what actually ranks for that search. Every result on page one of Google is a job board category page. Not one is an article. They each stamp a salary number into the title tag and then show you nothing behind it — one ZipRecruiter page advertises $90K–$100K, a sibling page on the same site advertises $72K–$150K, and a third advertises $92K–$330K. Three numbers, one site, no denominator anywhere.

Here is the part nobody on that page will tell you: the filter that decides whether you get a remote risk job is not seniority, and it is not your certification. It is your specialty. "Risk management" is at least eight different jobs that share a word, and their remote rates differ by a hundred percentage points. Model risk went three-for-three remote in our sample. Enterprise and operational risk — the thing most people picture when they hear "risk manager" — went zero-for-nine.

We analyzed 112 US risk management job postings across 46 employers, pulled from a sweep of 1,368 live public ATS job boards on September 18, 2026. This guide covers what share of those roles are genuinely remote, what each specialty actually pays, which 14 employers were hiring remote risk people that week, and what the FRM and CRISC really cost before you enroll.

Those last two numbers are both correct and they are seventy-five thousand dollars apart. The gap is the whole story, and we come back to it below.

---

How We Collected This Data

The figures in this post come from a single-day sweep of public applicant tracking system APIs run on September 18, 2026. We queried 1,127 employer board tokens against four public, unauthenticated endpoints — Greenhouse, Lever, Ashby and SmartRecruiters. 1,368 boards responded and returned 34,492 live postings.

We title-matched every posting containing the word "risk," then hand-excluded the software engineering, data science, design, sales, legal and recruiting titles that merely contain it — "Backend Engineer, Payments and Risk" is an engineering job, not a risk job. We then excluded non-US locations. That left n=112 risk management postings across 46 employers.

Work model was classified by reading the location field and the description body, never the ATS remote flag. The flags lie in both directions, and we caught it happening three times in this sample alone. Anthropic tags a risk role "Remote-Friendly" and then states a hybrid policy of at least 25% office time. Gemini lists "Remote (USA)" and describes "a hybrid work approach at our hub offices." Samsara's only use of the word "hybrid" sits inside a boilerplate equal-opportunity paragraph, so we counted it remote. Pay figures are employer-posted ranges only (n=43); we published no estimates.

One skew to disclose plainly: the board list is weighted toward technology, fintech and insurtech employers, which pay above the national occupational median. It is a strong primary source for what remote risk roles pay right now and a weak proxy for the occupation as a whole. We cross-referenced it against O*NET OnLine's republication of the BLS Occupational Employment and Wage Statistics series for Financial Risk Specialists, SOC 13-2054.00.

Three gaps. Reddit is blocked to automated access, so this post makes no claims about practitioner sentiment. BLS.gov returns 403 to automated requests, so the wage series was read through O*NET, which labels its source. Glassdoor and ZipRecruiter figures were visible only in search snippets and contradicted each other, so they appear here as evidence of SERP noise, not as verified data. Figures reflect postings live on September 18, 2026.

---

The Eight Risk Specialties, and Which Ones Actually Go Remote

The job boards treat "risk management" as one keyword. No hiring manager does. A model risk lead and an enterprise risk director share a word and almost nothing else — different regulators, different deliverables, different rooms. And the difference in what those deliverables physically are turns out to predict remote availability better than anything on your resume.

That is the idea behind the framework we use for the rest of this post.

Run the 112 postings through that lens and the pattern holds almost cleanly.

All counts from our September 18, 2026 sweep, n=112. Model risk (n=3) and market risk (n=1) are directional only — three of three tells you something about the kind of work model risk is, not that every model risk job in America is remote. The rows with n=13 and n=14 are where you should anchor.

The zero in the operational and enterprise risk row is the one worth sitting with, because it is not an accident of sample size. Nine postings, zero remote. Operational and enterprise risk did not stay office-bound because the profession is old-fashioned. It stayed office-bound because of what the job physically produces. An enterprise risk assessment is not a document you write — it is a document that records a negotiation. Someone has to sit in the board risk committee and read the room while the CFO argues the appetite statement is too conservative. Someone has to walk the third-party data center and notice that the badge reader has been propped open with a fire extinguisher for six months. Control walkthroughs, regulator meetings, and incident post-mortems are calendar-anchored and politically negotiated. That is a presence problem, not a file transfer problem, and no collaboration tool has solved it.

Model risk sits at the other end for exactly the inverse reason. A model validation is a file that arrives, gets reviewed, and gets challenged in writing. The regulator's expectation — independent challenge, documented — is easier to evidence when the challenge happens in a comment thread than when it happens in a hallway.

This is not a seniority effect. Our sample contains office-anchored operational risk roles at every level from analyst to VP, and remote model risk roles at both specialist and senior manager grade — Affirm posted a Security Risk Management Specialist II and an Underwriting/Credit Model Risk Senior Manager, both remote, four levels apart. Specialty decides whether the job can be remote at all. Seniority only decides what you are paid inside that answer.

---

What Remote Risk Roles Actually Pay

Of the 112 postings, 43 published an explicit annual base range. Those 43 have a median low of $160,000, a median high of $210,000, and a median midpoint of $192,500. Every figure below is quoted from an employer's own posting on September 18, 2026 — no estimates, no aggregator averages, no salary-tool modeling.

Salary figures in this section derive from our sweep of 1,368 public ATS boards on September 18, 2026, filtered to US risk management roles that published a base range (n=43 of 112). We cross-referenced the occupational baseline against the BLS wage series for SOC 13-2054.00 via O*NET. Ranges are base salary only and exclude equity and bonus, which run materially higher at later-stage and public companies.

Now put that next to the occupational baseline. O*NET's republication of the BLS wage series puts the national median for Financial Risk Specialists at $117,330 on 2025 data, across 60,500 employed people, with growth projected at 7% or higher through 2034 and roughly 4,800 openings a year. Our sample's median midpoint is $192,500.

Both numbers are accurate. The BLS series covers the entire occupation — regional banks, insurance carriers, hospital systems, credit unions, state agencies. Our sample covers technology, fintech and insurtech. The delta is an industry premium, and for most risk professionals it is larger than every raise they have ever negotiated, added together. A credit risk analyst who moves from a regional bank to a lender like Prosper or Figure is not getting promoted. They are getting repriced.

This is also why the single number in a job board's title tag is worse than useless. A page advertising "$90k-$100k Remote Risk Management Jobs" is describing a slice of the compliance-blended band and calling it the market. The same site's other page says $92K–$330K. Neither is lying; both are meaningless without a specialty attached. Pay in this field is not a distribution with a center. It is eight distributions stacked on one keyword.

Make it concrete. If you are a credit risk person looking for remote work, the remote-eligible manager role in our sample was Figure's Credit Risk Manager at $135K–$168K. If you are a model risk person, the remote-eligible lead role was Affirm's Financial Model Risk Management Lead at $185K–$245K. Same seniority band, same week, same country, fifty thousand dollars apart. Risk management does not have a salary. It has eight salaries, and the job board that shows you all of them averaged into one number is describing nobody.

---

Who Was Actually Hiring Remote Risk

Twenty-five genuinely remote postings, spread across 14 employers. Where those 14 cluster matters more than the count.

Eleven of the 14 are fintech, insurtech or infrastructure companies founded after 2010. These companies built distributed engineering organizations first and grew risk functions inside them afterward, which means the risk team inherited an operating model that already assumed nobody shares a floor. A ninety-year-old carrier's risk function inherited a building, a committee calendar, and a filing room. Both organizations face the same regulators. Only one of them has to solve the presence problem from scratch.

The outlier is worth noting because it breaks the pattern usefully: Oklo is an advanced fission company hiring a probabilistic risk assessment engineer remotely. PRA is nuclear safety modeling — about as high-consequence as risk work gets — and it is remote-eligible for the same reason model risk is. The deliverable is a fault tree, and a fault tree is a file.

Three patterns that cost people a relocation

We found all three of these in the same 112 postings, and each one is disclosed somewhere in the text that most candidates never reach.

The quarterly-onsite pattern. Coinbase posts risk roles with the location "Remote - USA." The body of those same postings says the company is "remote-first, but not remote-only" and that employees should "expect to get together quarterly for intense in-person working sessions called 'surges.'" That is not deceptive — it is plain English, disclosed in the posting. But it changes the calculus if you were planning to take the job from somewhere with no direct flights. A risk posting that says "remote" and mentions quarterly onsites is a hybrid job with better marketing, and you are the one person in the building professionally obligated to read the disclosure before signing.

The percentage-policy pattern. Anthropic tagged a product risk role "Remote-Friendly (Travel-Required)" and then stated a location-based hybrid policy expecting staff in an office at least 25% of the time. "Remote-friendly" in a location field is not a work model. It is a recruiting-funnel term, and the actual policy lives several hundred words down the page.

The hub pattern. Gemini listed a risk analytics role as "New York, New York; Miami, Florida; Remote (USA)" and described "a hybrid work approach at our hub offices." When a posting lists named cities alongside "remote," the safe reading is that remote is an exception granted to strong candidates, not the default. Two of our 112 postings resolved this way once we read the body.

The structural reason these exist is worth understanding, because it tells you when the risk of conversion is highest. Risk functions are the part of a company that a regulator or an auditor physically visits. When an exam, a board risk committee cycle, or an incident review lands, the pressure to put the risk team in a room is external and non-negotiable. That is when "remote-first" quietly becomes "remote-except-when-it-matters." Ask in the final round how the team operated during its most recent exam or audit — the answer is more predictive than the policy page.

---

The Certification Math

Risk certifications are priced like a career investment and gated like one. Both facts get buried under the marketing, so here are the published numbers from the certifying bodies themselves.

The FRM fee schedule is public and unambiguous: a one-time $400 enrollment plus $800 for each of two exam parts. Part I is 100 multiple-choice questions on risk foundations, quantitative analysis, markets and valuation; Part II is 80 questions applying those tools to market, credit, operational and liquidity risk. ISACA lists CRISC at $575 for members and $760 for non-members.

On RIMS-CRMP we have to be honest about a gap: RIMS does not publish fees, eligibility requirements, or exam format on its credential page. It routes you to a candidate handbook. Third-party sites quote numbers for it; we are not repeating numbers we could not verify at the source, in a post about risk, to an audience of people who verify things for a living.

Now the part that matters. The FRM is the prestige credential in this field, and it points at credit and market risk — a Gradient 6 and a Gradient 3. CRISC costs roughly a quarter as much and points at security and GRC, which was the highest-volume remote specialty in our sample at 5 of 13 postings, a Gradient 8. The credential the industry respects most and the credential the remote market rewards most are not the same credential. That is not an argument against the FRM if you are targeting a bank. It is an argument for knowing which market you are actually shopping in.

---

How to Move Into a Portable Specialty

If the Gradient put you at 1–3 and you want remote work, the efficient move is a lateral, not a longer search. Which lateral is not a preference question — it is determined by what you already produce.

Start here. Does your current work already generate auditable artifacts — test plans, evidence files, findings that survive challenge? Go to security and GRC. Do you already build scorecards, or work in Python, R or SAS? Go to model risk. Do you negotiate contracts and chase suppliers for documentation, but have no appetite for modeling? Go to third-party risk. If none of those describe you, the honest answer is that the bridge is longer than one move and you should expect a title drop of a full level, not half of one.

Internal audit or SOX to security and GRC. You already design control tests, gather evidence, and write findings that survive challenge. The vocabulary changes — SOC 2, ISO 27001, access reviews — and the work product does not. This is the shortest bridge in the field and it lands you in the specialty with the most remote volume in our sample (5 of 13 postings).

Credit analysis or underwriting to model risk. The gate here is tooling, and it is specific. O*NET lists SAS, MATLAB, IBM SPSS, Python, R, Tableau and Power BI as the technology skills for SOC 13-2054.00, and the model risk postings in our sample read like that list with a validation framework wrapped around it. If you already build scorecards, you are closer than you think. If you have never written a line of Python, that is the semester of work standing between you and a Gradient 10 specialty paying $185K–$245K.

Procurement or vendor management to third-party risk. Only 5 of 112 postings, so it is thin — but it scores an 8 on the Gradient, and almost nobody applying to it comes from a risk background. You already know how to read a contract and chase a supplier for documentation. The addition is control assessment.

None of these is clean. Expect the lateral to cost you a title level for twelve to eighteen months, because you are trading domain seniority for domain novelty and every hiring manager prices that in. Expect the first six months to include a meeting where you do not know which regulator someone is referring to by acronym. That is the actual cost, and it is worth paying once rather than absorbing a permanent handicap against the 78% of postings (n=87 of 112) that were never genuinely remote in the first place.

In most fields the lateral is a retreat. In risk it is the only move that changes both your remote odds and your ceiling at once — because you are not trading down in seniority, you are trading out of a specialty whose deliverable happens to be a room.

You can shortcut the search half of this. Our auto-apply service filters by role and work model so you are not manually opening 112 postings to find the 25 that are real — which is, roughly, the exercise this post documents.

---

Frequently Asked Questions

---

Start Your Remote Risk Management Search

Three things to do with this, in order.

First, score your specialty on the Gradient and write the number down. If you are Anchored at 1–3, stop rewriting your resume. A resume cannot fix a specialty whose deliverable is a room.

Second, go direct to boards, not aggregators. Every posting cited in this article came from a company's own applicant tracking system, which is public and unauthenticated. The 14 employers in the table above are your starting list — check Affirm, Upstart, Figure and Prosper for credit and model risk; Confluent, CoreWeave and Modern Health for security and GRC; Counterpart and Samsara for insurance-side and third-party risk. The same logic applies to adjacent fields like remote compliance roles and remote finance jobs.

Third, if the math says lateral, pick the bridge that matches what you already produce — remote cybersecurity jobs and SOC analyst roles for the GRC path, remote underwriting roles and remote data analyst roles for the model risk path, and remote procurement jobs for the third-party path.

For context on how risk pay compares across the broader finance function, our guides to remote financial analyst positions and remote banking jobs cover the adjacent bands, and remote insurance jobs covers the carrier side where the Counterpart-style risk engineering roles live. If you are applying steadily and hearing nothing, why you're not getting interviews covers the other half of the problem.

Risk is the discipline of knowing what a thing actually costs. Start by pricing the search itself honestly.