Director, Information Technology & Security

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest. The Chief Information Security Officer (CISO) will serve as a key member of the Bank’s Executive Management Team and will be responsible for establishing and leading Bank’s information security and cybersecurity programs. As the Bank prepares to launch as a de novo Industrial Loan Company (ILC), the CISO will design and implement an enterprise-wide security framework that meets FDIC and state regulatory expectations, supports the Bank’s risk appetite, and protects customer and institutional data. The CISO will lead the development of information security governance, technical controls, and third-party risk oversight, ensuring a strong and scalable security posture from inception through growth. This leader will collaborate closely with technology, risk, and operations teams to ensure security is integrated into every aspect of the Bank’s systems and operations. What You’ll Do 1. Information Security Program Development - Design, implement, and maintain a comprehensive Information Security Program consistent with FDIC guidance (e.g., FIL-66-2019, FIL-13-2021) and the Interagency Guidelines Establishing Information Security Standards. - Develop and oversee policies, standards, and procedures governing cybersecurity, data protection, and incident response. - Ensure alignment with the Bank’s overall risk management and governance frameworks. - Provide regular reporting to executive management and the Board on the Bank’s security posture, emerging risks, and mitigation efforts. 2. Cybersecurity and Threat Management - Establish and manage a threat monitoring and detection capability to identify, assess, and respond to cybersecurity risks. - Oversee implementation of layered security controls (e.g., network segmentation, encryption, access controls, endpoint protection, vulnerability management). - Lead the Bank’s Incident Response Program, ensuring timely escalation and coordination with regulators when required. - Maintain relationships with information-sharing groups (e.g., FS-ISAC) and law enforcement to stay informed of emerging threats. 3. Third-Party and Affiliate Risk Oversight - Evaluate the information security posture of third-party and affiliate service providers in accordance with the Bank’s Vendor Management Program and FDIC third-party risk guidance. - Establish due diligence, ongoing monitoring, and contractual requirements for vendors handling sensitive data or performing critical services. - Coordinate with Operations, Compliance, and Internal Audit to ensure third-party risks are identified, assessed, and mitigated. 4. Data Governance and Privacy Protection - Ensure compliance with applicable privacy and data protection requirements (e.g., GLBA, Regulation P, state privacy laws). - Implement processes to safeguard customer information and prevent unauthorized access, disclosure, or misuse. - Partner with business and technology teams to integrate privacy-by-design principles into new products and services. 5. Business Continuity and Resilience - Lead development and testing of the Bank’s Business Continuity and Disaster Recovery (BC/DR) plans, ensuring they are integrated with information security objectives. - Coordinate regular testing and simulations to validate readiness for cyber incidents and system disruptions. - Support resilience planning for key systems, vendors, and communication protocols. 6. De Novo and Pre-Opening Readiness - Build and document the Bank’s information security program as part of the de novo application process. - Establish security architecture, monitoring tools, and vendor relationships prior to launch. - Prepare readiness materials for FDIC and state examinations related to cybersecurity and operational resilience. - Ensure security risk assessments and third-party reviews are completed and incorporated into pre-opening milestones. 7. Leadership and Culture - Serve as the Bank’s senior advocate for cybersecurity and data protection, promoting a culture of security awareness and accountability. - Provide training and guidance across the organization to enhance information security awareness. - Collaborate with peers in Risk, Compliance, Operations, and Technology to align security priorities with business strategy. - Build and lead a capable, mission-driven security team to support the Bank’s evolving needs. What We Look For - Minimum of 10 years of information security and technology risk management experience, with at least 5 years in a leadership capacity at a regulated financial institution or Fintech. - Demonstrated experience designing and implementing information security programs compliant with FDIC and FFIEC standards. - Strong familiarity with third-party risk frameworks and financial services cybersecuri

Minimum of 10 years of information security and technology risk management experience, with at least 5 years in a leadership capacity at a regulated financial institution or Fintech. Demonstrated experience designing and implementing information security programs compliant with FDIC and FFIEC standards. Strong familiarity with third-party risk frameworks and financial services cybersecurity.

Lead the development and execution of an enterprise-wide Information Security Program aligned with FDIC guidance and interagency standards. Develop and oversee policies, standards, and procedures for cybersecurity, data protection, and incident response; report security posture and risks to executive management and the Board. Establish and manage threat monitoring and detection capabilities; implement layered security controls (network segmentation, encryption, access controls, endpoint protection, vulnerability management); oversee Incident Response Program and coordinate with regulators as required. Manage third-party and affiliate risk oversight, due diligence, and contractual requirements within Vendor Management practices; coordinate with Operations, Compliance, and Internal Audit. Ensure data governance and privacy protection in line with GLBA, Regulation P, and state privacy laws; promote privacy-by-design across products. Lead Business Continuity and Disaster Recovery planning and testing; coordinate simulations and resilience planning for key systems and vendors. Prepare the security program for de novo/delivery readiness and pre-opening activities, including security architecture, monitoring tools, and vendor relationships. Promote a culture of security, provide organization-wide training, and align security priorities with business strategy; build and lead a capable security team.