Director, Information Technology & Security

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest.

Remote US

The Director, Information Technology & Security will serve as a key member of the Bank's Management Team, serving as the Chief Information Security Officer, and will be responsible for establishing and leading the Bank's information security and cybersecurity programs. As the Bank prepares to launch as a de novo Industrial Loan Company (ILC), this leader will design and implement an enterprise-wide security framework that meets FDIC and state regulatory expectations, supports the Bank's risk appetite, and protects customer and institutional data.

1. Oversee infrastructure design and IT Engineering 
2. Information Security Program Development

• Design, implement, and maintain a comprehensive Information Security Program consistent with FDIC guidance (e.g., FIL-66-2019, FIL-13-2021) and the Interagency Guidelines Establishing Information Security Standards.
• Develop and oversee policies, standards, and procedures governing cybersecurity, data protection, and incident response.
• Ensure alignment with the Bank’s overall risk management and governance frameworks.
• Provide regular reporting to executive management and the Board on the Bank’s security posture, emerging risks, and mitigation efforts.
• Lead the technical build phase of the Bank's infrastructure, providing direct oversight and hands-on guidance for cloud security and DevOps integration.
• Partner deeply with Engineering to define and implement secure technical architectures, including network segmentation, encryption standards, and identity governance.

1. Cybersecurity and Threat Management

• Establish and manage a threat monitoring and detection capability to identify, assess, and respond to cybersecurity risks.
• Oversee implementation of layered security controls (e.g., network segmentation, encryption, access controls, endpoint protection, vulnerability management).
• Lead the Bank’s Incident Response Program, ensuring timely escalation and coordination with regulators when required.
• Maintain relationships with information-sharing groups (e.g., FS-ISAC) and law enforcement to stay informed of emerging threats.

• Minimum of 10 years of experience in information technology, and security and technology risk management, with a proven track record of moving between strategic planning and hands-on technical execution.
• Demonstrated experience designing and implementing information security programs compliant with FDIC and FFIEC standards.
• Strong familiarity with third-party risk frameworks and financial services cybersecurity expectations.
• Experience leading incident response, penetration testing, and security operations in cloud-based and hybrid environments.
• Proven ability to communicate complex technical topics to executive leadership, the Board, and regulators.
• Strong leadership, analytical, and problem-solving skills with a risk-based and pragmatic approach to decision-making.
• Deep expertise in cloud-native infrastructure (AWS/GCP), DevOps practices, and software-defined security controls.
• Demonstrated ability to "roll up sleeves" and contribute directly to the technology build while simultaneously managing executive stakeholders and regulators.