Director, Information Technology & Security

Acts as Chief Information Security Officer for Affirm's planned bank, a de novo industrial loan company, and sits on the bank's management team. The role builds the bank's information security and cybersecurity programmes from scratch and also oversees its infrastructure design and IT engineering.

The director designs a security programme that satisfies FDIC and state examiners, writes the policies and standards behind it, and reports to executives and the board on posture and risk. During the build phase the job is hands-on: leading cloud security and DevOps integration, and working with engineering on network segmentation, encryption and identity governance. The role sets up threat monitoring and detection, layered controls and vulnerability management, runs incident response including escalation to regulators, and keeps ties with FS-ISAC and law enforcement. Other responsibilities include third-party and affiliate security risk, privacy obligations under GLBA and Regulation P, support for business continuity and disaster recovery testing, pre-opening readiness material for examinations, staff awareness training, and hiring a security team.

Affirm wants at least ten years across IT, security and technology risk with a record of moving between strategy and hands-on work, experience building programmes that meet FDIC and FFIEC standards, and practical experience leading security operations, penetration testing and incident response across hybrid and cloud estates. Deep AWS or GCP and DevOps knowledge and the ability to brief boards and regulators are expected. The role is remote in the US, without visa sponsorship.