Director+

Affirm is seeking a Director, Information Technology & Security to serve as a key member of the Bank's Management Team, acting as the Chief Information Security Officer. This role will establish and lead the Bank's information security and cybersecurity programs as it prepares to launch as a de novo Industrial Loan Company (ILC). The leader will design and implement an enterprise-wide security framework meeting FDIC and state regulatory expectations, support the Bank's risk appetite, and protect customer and institutional data. This is a blended leadership role requiring both high-level strategic influence and deep technical execution.

• Oversee infrastructure design and IT Engineering, including leading the technical build phase of the Bank's infrastructure with hands-on guidance for cloud security and DevOps integration.
• Design, implement, and maintain a comprehensive Information Security Program consistent with FDIC guidance and Interagency Guidelines.
• Develop and oversee policies, standards, and procedures for cybersecurity, data protection, and incident response.
• Establish and manage threat monitoring and detection, layered security controls, and the Incident Response Program.
• Evaluate third-party and affiliate information security posture in accordance with the Bank's Vendor Management Program and FDIC third-party risk guidance.
• Ensure compliance with privacy and data protection requirements (e.g., GLBA, Regulation P, state privacy laws).
• Assist in developing and testing Business Continuity and Disaster Recovery plans.
• Build and document the technology and information security program for the de novo application process.
• Serve as the Bank's senior advocate for cybersecurity, promoting a culture of security awareness.

• Minimum of 10 years of experience in information technology, security, and technology risk management.
• Demonstrated experience designing and implementing information security programs compliant with FDIC and FFIEC standards.
• Strong familiarity with third-party risk frameworks and financial services cybersecurity expectations.
• Experience leading incident response, penetration testing, and security operations in cloud-based and hybrid environments.
• Deep expertise in cloud-native infrastructure (AWS/GCP), DevOps practices, and software-defined security controls.
• Proven ability to communicate complex technical topics to executive leadership, the Board, and regulators.

Base pay range: USA Pacific (CA, WA, NY, NJ, CT) $300,000 - $360,000; USA Sapphire (all other U.S. states) $267,000 - $327,000. Total compensation may include monthly stipends for health, wellness, and tech spending, and benefits including 100% subsidized medical coverage, dental, and vision for you and your dependents. Employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).

Visa sponsorship is not available for this position.