Director, Information Technology & Security

Affirm; United States; Remote; USD 260,000 - 340,000; Full time

Job summary

Affirm is seeking a Director, Information Technology & Security to serve as Chief Information Security Officer for a de novo Industrial Loan Company. This blended leadership role combines strategic influence with hands-on technical execution to secure enterprise systems and customer data.

You will architect and lead an enterprise-wide security program aligned with FDIC guidance, manage incident response, and partner with Engineering and risk teams to embed secure design across cloud, network,

Qualifications

• Experience leading enterprise information security programs and teams.
• Strong knowledge of FDIC guidance and regulatory expectations.
• Hands-on build experience with cloud platforms, security controls, and secure architecture.

Responsibilities

• Oversee enterprise information security governance and program development.
• Lead infrastructure design and IT engineering with security integration.
• Design, implement, and maintain a comprehensive security program aligned with regulatory guidance.
• Develop policies, standards, and procedures for cybersecurity, data protection, and incident response.
• Provide regular security posture reporting to executives and the Board.
• Lead hands-on security build in cloud and DevOps contexts, guiding engineers.

Skills

Information security leadership

Cloud security

DevOps

Incident response

Vendor risk management

Job description

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest.

Remote US

The Director, Information Technology & Security will serve as a key member of the Bank's Management Team, serving as the Chief Information Security Officer, and will be responsible for establishing and leading the Bank's information security and cybersecurity programs. As the Bank prepares to launch as a de novo Industrial Loan Company (ILC), this leader will design and implement an enterprise-wide security framework that meets FDIC and state regulatory expectations, supports the Bank's risk appetite, and protects customer and institutional data.

This is a blended leadership role requiring both high-level strategic influence and deep technical execution. You will lead the development of information security governance, technical controls, and oversight of infrastructure and engineering, ensuring a strong and scalable security posture from inception. This leader must be a practitioner at heart—willing to "roll up their sleeves" to lead the technical build phase, collaborate closely with engineering on architecture, and ensure security is integrated into every aspect of the Bank's systems and operations.

What You’ll Do

• Oversee infrastructure design and IT Engineering
• Information Security Program Development
• Design, implement, and maintain a comprehensive Information Security Program consistent with FDIC guidance (e.g., FIL-66-2019, FIL-13-2021) and the Interagency Guidelines Establishing Information Security Standards.
• Develop and oversee policies, standards, and procedures governing cybersecurity, data protection, and incident response.
• Ensure alignment with the Bank’s overall risk management and governance frameworks.
• Provide regular reporting to executive management and the Board on the Bank’s security posture, emerging risks, and mitigation efforts.
• Lead the technical build phase of the Bank's infrastructure, providing direct oversight and hands‑on guidance for cloud security and DevOps integration.
• Partner deeply with Engineering to define and implement secure technical architectures, including network segmentation, encryption standards, and identity governance.

Cybersecurity and Threat Management

• Establish and manage a threat monitoring and detection capability to identify, assess, and respond to cybersecurity risks.
• Oversee implementation of layered security controls (e.g., network segmentation, encryption, access controls, endpoint protection, vulnerability management).
• Lead the Bank’s Incident Response Program, ensuring timely escalation and coordination with regulators when required.
• Maintain relationships with information-sharing groups (e.g., FS-ISAC) and law enforcement to stay informed of emerging threats.

Third-Party and Affiliate Risk Oversight

• Evaluate the information security posture of third-party and affiliate service providers in accordance with the Bank’s Vendor Management Program and FDIC third-party risk guidance.
• Establish due diligence, ongoing monitoring, and contractual requirements for vendors handling sensitive data or performing critical services.
• Coordinate with Operations, Compliance, and Internal Audit to ensure third-party risks are identified, assessed, and mitigated.