Director, Information Technology & Security

Affirm is hiring a Director of Information Technology & Security to serve as Chief Information Security Officer for its de novo Industrial Loan Company (ILC) launch. This remote US role reports to senior management and carries responsibility for designing and implementing enterprise-wide security infrastructure that meets FDIC and state regulatory standards while protecting customer data and institutional assets. The position blends strategic leadership with hands-on technical execution, requiring both governance design and direct involvement in the Bank's infrastructure build phase.

Responsibilities

• Design, implement, and maintain a comprehensive Information Security Program aligned with FDIC guidance (FIL-66-2019, FIL-13-2021) and Interagency Guidelines Establishing Information Security Standards
• Develop and oversee information security policies, standards, and procedures covering cybersecurity, data protection, and incident response
• Ensure security governance aligns with the Bank's overall risk management and governance frameworks
• Provide regular reporting to executive management and Board of Directors on security posture, emerging risks, and mitigation strategies
• Lead the technical build phase of Bank infrastructure with direct oversight of cloud security and DevOps integration
• Collaborate with Engineering to define secure technical architectures including network segmentation, encryption standards, and identity governance
• Establish and manage threat monitoring and detection capabilities to identify, assess, and respond to cybersecurity risks
• Oversee implementation of layered security controls including network segmentation, encryption, access controls, endpoint protection, and vulnerability management
• Lead the Bank's Incident Response Program, ensuring timely escalation and regulatory coordination
• Oversee infrastructure design and IT Engineering functions

Requirements

• Deep expertise in information security program development and FDIC regulatory compliance
• Hands-on technical knowledge of cloud security, network architecture, encryption, and identity and access management
• Experience designing and implementing enterprise-scale security infrastructure
• Demonstrated capability leading incident response programs
• Ability to translate regulatory guidance into operational security controls and governance
• Experience collaborating with engineering and infrastructure teams on secure architecture design