{"absolute_url":"https://job-boards.greenhouse.io/affirm/jobs/7607567003","data_compliance":[{"type":"gdpr","requires_consent":false,"requires_processing_consent":false,"requires_retention_consent":false,"retention_period":null,"demographic_data_consent_applies":false}],"internal_job_id":5708837003,"location":{"name":"Remote US"},"metadata":[{"id":4128552003,"name":"External Department","value":"Finance","value_type":"single_select"},{"id":28890347003,"name":"PERM Job?","value":false,"value_type":"yes_no"}],"id":7607567003,"updated_at":"2026-09-14T17:25:53-04:00","requisition_id":"JR103673","title":"Director, Information Technology \u0026 Security","company_name":"Affirm","first_published":"2026-02-02T13:09:19-05:00","language":"en","application_deadline":null,"content":"\u0026lt;div class=\u0026quot;content-intro\u0026quot;\u0026gt;\u0026lt;p\u0026gt;At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most.\u0026lt;/p\u0026gt;\u0026lt;/div\u0026gt;\u0026lt;p\u0026gt;Remote US\u0026lt;/p\u0026gt;\n\u0026lt;p\u0026gt;The Director, Information Technology \u0026amp;amp; Security will serve as a key member of the Bank\u0026#39;s Management Team, serving as the Chief Information Security Officer, and will be responsible for establishing and leading the Bank\u0026#39;s information security and cybersecurity programs. As the Bank prepares to launch as a de novo Industrial Loan Company (ILC), this leader will design and implement an enterprise-wide security framework that meets FDIC and state regulatory expectations, supports the Bank\u0026#39;s risk appetite, and protects customer and institutional data.\u0026lt;/p\u0026gt;\n\u0026lt;p\u0026gt;This is a blended leadership role requiring both high-level strategic influence and deep technical execution. You will lead the development of information security governance, technical controls, and oversight of infrastructure and engineering, ensuring a strong and scalable security posture from inception. This leader must be a practitioner at heart—willing to \u0026quot;roll up their sleeves\u0026quot; to lead the technical build phase, collaborate closely with engineering on architecture, and ensure security is integrated into every aspect of the Bank\u0026#39;s systems and operations.\u0026lt;/p\u0026gt;\n\u0026lt;h3\u0026gt;\u0026lt;strong\u0026gt;What You’ll Do\u0026lt;/strong\u0026gt;\u0026lt;/h3\u0026gt;\n\u0026lt;ol\u0026gt;\n\u0026lt;li\u0026gt;Oversee infrastructure design and IT Engineering\u0026amp;nbsp;\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Information Security Program Development\u0026lt;/li\u0026gt;\n\u0026lt;/ol\u0026gt;\n\u0026lt;ul\u0026gt;\n\u0026lt;li\u0026gt;Design, implement, and maintain a comprehensive Information Security Program consistent with FDIC guidance (e.g., FIL-66-2019, FIL-13-2021) and the Interagency Guidelines Establishing Information Security Standards.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Develop and oversee policies, standards, and procedures governing cybersecurity, data protection, and incident response.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Ensure alignment with the Bank’s overall risk management and governance frameworks.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Provide regular reporting to executive management and the Board on the Bank’s security posture, emerging risks, and mitigation efforts.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Lead the technical build phase of the Bank\u0026#39;s infrastructure, providing direct oversight and hands-on guidance for cloud security and DevOps integration.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Partner deeply with Engineering to define and implement secure technical architectures, including network segmentation, encryption standards, and identity governance.\u0026lt;/li\u0026gt;\n\u0026lt;/ul\u0026gt;\n\u0026lt;ol\u0026gt;\n\u0026lt;li\u0026gt;Cybersecurity and Threat Management\u0026lt;/li\u0026gt;\n\u0026lt;/ol\u0026gt;\n\u0026lt;ul\u0026gt;\n\u0026lt;li\u0026gt;Establish and manage a threat monitoring and detection capability to identify, assess, and respond to cybersecurity risks.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Oversee implementation of layered security controls (e.g., network segmentation, encryption, access controls, endpoint protection, vulnerability management).\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Lead the Bank’s Incident Response Program, ensuring timely escalation and coordination with regulators when required.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Maintain relationships with information-sharing groups (e.g., FS-ISAC) and law enforcement to stay informed of emerging threats.\u0026lt;/li\u0026gt;\n\u0026lt;/ul\u0026gt;\n\u0026lt;ol\u0026gt;\n\u0026lt;li\u0026gt;Third-Party and Affiliate Risk Oversight\u0026lt;/li\u0026gt;\n\u0026lt;/ol\u0026gt;\n\u0026lt;ul\u0026gt;\n\u0026lt;li\u0026gt;Evaluate the information security posture of third-party and affiliate service providers in accordance with the Bank’s Vendor Management Program and FDIC third-party risk guidance.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Establish due diligence, ongoing monitoring, and contractual requirements for vendors handling sensitive data or performing critical services.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Coordinate with Operations, Compliance, and Internal Audit to ensure third-party risks are identified, assessed, and mitigated.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Manage the technical lifecycle of security-critical third-party service providers, ensuring rigorous operational oversight of vendors handling sensitive financial data.\u0026lt;/li\u0026gt;\n\u0026lt;/ul\u0026gt;\n\u0026lt;ol\u0026gt;\n\u0026lt;li\u0026gt;Data Governance and Privacy Protection\u0026lt;/li\u0026gt;\n\u0026lt;/ol\u0026gt;\n\u0026lt;ul\u0026gt;\n\u0026lt;li\u0026gt;Ensure compliance with applicable privacy and data protection requirements (e.g., GLBA, Regulation P, state privacy laws).\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Implement processes to safeguard customer information and prevent unauthorized access, disclosure, or misuse.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Partner with business and technology teams to integrate privacy-by-design principles into new products and services.\u0026lt;/li\u0026gt;\n\u0026lt;/ul\u0026gt;\n\u0026lt;ol\u0026gt;\n\u0026lt;li\u0026gt;Business Continuity and Resilience\u0026lt;/li\u0026gt;\n\u0026lt;/ol\u0026gt;\n\u0026lt;ul\u0026gt;\n\u0026lt;li\u0026gt;Assist Risk Officer in development and testing of the Bank’s Business Continuity and Disaster Recovery (BC/DR) plans, ensuring they are integrated with information security objectives.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Coordinate regular testing and simulations to validate readiness for cyber incidents and system disruptions.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Support resilience planning for key systems, vendors, and communication protocols.\u0026lt;/li\u0026gt;\n\u0026lt;/ul\u0026gt;\n\u0026lt;ol\u0026gt;\n\u0026lt;li\u0026gt;De Novo and Pre-Opening Readiness\u0026lt;/li\u0026gt;\n\u0026lt;/ol\u0026gt;\n\u0026lt;ul\u0026gt;\n\u0026lt;li\u0026gt;Build and document the Bank’s technology and information security program as part of the de novo application process.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Establish security architecture, monitoring tools, and vendor relationships prior to launch.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Prepare readiness materials for FDIC and state examinations related to cybersecurity and operational resilience.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Ensure security risk assessments and third-party reviews are completed and incorporated into pre-opening milestones.\u0026lt;/li\u0026gt;\n\u0026lt;/ul\u0026gt;\n\u0026lt;ol\u0026gt;\n\u0026lt;li\u0026gt;Leadership and Culture\u0026lt;/li\u0026gt;\n\u0026lt;/ol\u0026gt;\n\u0026lt;ul\u0026gt;\n\u0026lt;li\u0026gt;Serve as the Bank’s senior advocate for cybersecurity and data protection, promoting a culture of security awareness and accountability.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Provide training and guidance across the organization to enhance information security awareness.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Collaborate with peers in Risk, Compliance, Operations, and Technology to align security priorities with business strategy.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Build and lead a capable, mission-driven security team to support the Bank’s evolving needs.\u0026lt;/li\u0026gt;\n\u0026lt;/ul\u0026gt;\n\u0026lt;h3\u0026gt;\u0026lt;strong\u0026gt;What We Look For\u0026lt;/strong\u0026gt;\u0026lt;/h3\u0026gt;\n\u0026lt;ul\u0026gt;\n\u0026lt;li\u0026gt;Minimum of 10 years of experience in information technology, and security and technology risk management, with a proven track record of moving between strategic planning and hands-on technical execution.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Demonstrated experience designing and implementing information security programs compliant with FDIC and FFIEC standards.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Strong familiarity with third-party risk frameworks and financial services cybersecurity expectations.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Experience leading incident response, penetration testing, and security operations in cloud-based and hybrid environments.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Proven ability to communicate complex technical topics to executive leadership, the Board, and regulators.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Strong leadership, analytical, and problem-solving skills with a risk-based and pragmatic approach to decision-making.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Deep expertise in cloud-native infrastructure (AWS/GCP), DevOps practices, and software-defined security controls.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Demonstrated ability to \u0026quot;roll up sleeves\u0026quot; and contribute directly to the technology build while simultaneously managing executive stakeholders and regulators.\u0026lt;/li\u0026gt;\n\u0026lt;/ul\u0026gt;\n\u0026lt;h3\u0026gt;\u0026lt;strong\u0026gt;Core Competencies\u0026lt;/strong\u0026gt;\u0026lt;/h3\u0026gt;\n\u0026lt;ul\u0026gt;\n\u0026lt;li\u0026gt;Expert knowledge of information security principles, frameworks, and regulatory requirements.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Strategic thinker with strong operational execution and control discipline.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Effective communicator capable of influencing across technical and business functions.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Collaborative leader who fosters a culture of accountability, awareness, and continuous improvement.\u0026lt;/li\u0026gt;\n\u0026lt;/ul\u0026gt;\n\u0026lt;h3\u0026gt;Affirm Values\u0026lt;/h3\u0026gt;\n\u0026lt;p\u0026gt;At Affirm, we live by our values: People Come First, No Fine Print, It’s On Us, Simplify, and Push the Envelope. As CCO, you will embody these principles while building the foundation of Affirm Bank as a trusted, transparent, and innovative financial institution.\u0026lt;/p\u0026gt;\n\u0026lt;p\u0026gt;\u0026lt;strong\u0026gt;Compensation \u0026amp;amp; Benefits\u0026lt;/strong\u0026gt;\u0026lt;/p\u0026gt;\n\u0026lt;p style=\u0026quot;text-align: left;\u0026quot;\u0026gt;\u0026lt;strong\u0026gt;Base Pay Grade\u0026lt;/strong\u0026gt;\u0026amp;nbsp;\u0026lt;strong\u0026gt;- T\u0026lt;/strong\u0026gt;\u0026lt;/p\u0026gt;\n\u0026lt;p style=\u0026quot;text-align: left;\u0026quot;\u0026gt;\u0026lt;strong\u0026gt;Equity Grade\u0026lt;/strong\u0026gt;\u0026amp;nbsp;\u0026lt;strong\u0026gt;- 14\u0026lt;/strong\u0026gt;\u0026lt;/p\u0026gt;\n\u0026lt;p style=\u0026quot;text-align: left;\u0026quot;\u0026gt;Employees new to Affirm \u0026lt;em\u0026gt;typically come in at the start of the pay range.\u0026lt;/em\u0026gt; Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.\u0026amp;nbsp;\u0026lt;/p\u0026gt;\n\u0026lt;p style=\u0026quot;text-align: left;\u0026quot;\u0026gt;Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).\u0026lt;/p\u0026gt;\n\u0026lt;div\u0026gt;\n\u0026lt;div\u0026gt;\n\u0026lt;div\u0026gt;\n\u0026lt;p\u0026gt;\u0026lt;strong\u0026gt;USA Pacific base pay range (CA, WA, NY, NJ, CT) per year:\u0026lt;/strong\u0026gt;\u0026lt;span style=\u0026quot;font-weight: 400;\u0026quot;\u0026gt; $300,000 - $360,000\u0026lt;/span\u0026gt;\u0026lt;/p\u0026gt;\n\u0026lt;p\u0026gt;\u0026lt;strong\u0026gt;USA Sapphire base pay range (all other U.S. states) per year:\u0026lt;/strong\u0026gt;\u0026lt;span style=\u0026quot;font-weight: 400;\u0026quot;\u0026gt; $267,000 - $327,000\u0026lt;/span\u0026gt;\u0026lt;/p\u0026gt;\n\u0026lt;p\u0026gt;\u0026lt;strong\u0026gt;Please note that visa sponsorship is not available for this position.\u0026lt;/strong\u0026gt;\u0026lt;/p\u0026gt;\n\u0026lt;/div\u0026gt;\n\u0026lt;/div\u0026gt;\n\u0026lt;/div\u0026gt;\n\u0026lt;p\u0026gt;#LI-Remote\u0026lt;/p\u0026gt;\n\u0026lt;p\u0026gt;\u0026amp;nbsp;\u0026lt;/p\u0026gt;\u0026lt;div class=\u0026quot;content-conclusion\u0026quot;\u0026gt;\u0026lt;div\u0026gt;\n\u0026lt;p\u0026gt;\u0026lt;strong\u0026gt;Remote-first with flexibility built in\u0026lt;/strong\u0026gt;\u0026lt;strong\u0026gt;\u0026lt;br\u0026gt;\u0026lt;/strong\u0026gt;Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience.\u0026lt;/p\u0026gt;\n\u0026lt;p\u0026gt;\u0026lt;strong\u0026gt;Benefits designed for you\u0026lt;/strong\u0026gt;\u0026lt;strong\u0026gt;\u0026lt;br\u0026gt;\u0026lt;/strong\u0026gt;Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights:\u0026lt;/p\u0026gt;\n\u0026lt;ul\u0026gt;\n\u0026lt;li\u0026gt;Health coverage at no cost: We cover 100% of premiums for employees and their dependents.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to.\u0026lt;/li\u0026gt;\n\u0026lt;li\u0026gt;Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount.\u0026lt;/li\u0026gt;\n\u0026lt;/ul\u0026gt;\n\u0026lt;p\u0026gt;We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help.\u0026lt;/p\u0026gt;\n\u0026lt;p\u0026gt;For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law.\u0026lt;/p\u0026gt;\n\u0026lt;/div\u0026gt;\n\u0026lt;div\u0026gt;\n\u0026lt;p\u0026gt;By clicking \u0026quot;Submit Application,\u0026quot; you acknowledge that you have read Affirm\u0026#39;s\u0026amp;nbsp;\u0026lt;a href=\u0026quot;https://www.affirm.com/global-candidate-privacy-notice\u0026quot; target=\u0026quot;_blank\u0026quot;\u0026gt;Global Candidate Privacy Notice\u0026lt;/a\u0026gt; and consent to the use of your personal information as described.\u0026lt;/p\u0026gt;\n\u0026lt;/div\u0026gt;\u0026lt;/div\u0026gt;","departments":[{"id":4141093003,"name":"Bank Strategy","child_ids":[],"parent_id":4005046003}],"offices":[{"id":4013021003,"name":"Remote US","location":null,"child_ids":[],"parent_id":4025301003}],"ai_disclaimer":null,"include_ai_disclaimer":false,"ai_opt_out_request_url":null}