[Hiring] Security Risk Management Lead @Affirm

Role Description

At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most.

About the team: Affirm values security as being critical to the company's continued success. Our mission is to cultivate a culture of security at Affirm, enabling the company to succeed in building honest financial products. The Security Risk Management team is evolving beyond traditional governance, risk, and compliance; we are building an engineering driven program that designs, automates, and scales the controls, workflows, and tooling that protect Affirm and our customers.

The ideal candidate will:

• Design, develop, configure, and implement solutions to complex technical and business problems across the Security Third Party Program and the broader Security Risk Management program.
• Shape policy and ship automation using modern tooling (Python, Cursor, Claude, and other agentic coding platforms).
• Operate as a subject matter expert, interface with business, legal, corporate development, and engineering stakeholders.
• Transform Security Risk Management from a compliance-oriented function into a security engineering discipline.

What You'll Do:

• Lead and mature Affirm's Security Third Party Program, including the design, implementation, and continuous improvement of processes, controls, and operational workflows.
• Own pre-launch security due diligence for third parties that support Affirm's entry into new international markets.
• Support Finance - Strategy & Development, Legal, and Security leadership on M&A security due diligence.
• Lead post-close integration of an acquired company's vendor portfolio into Affirm's third party program.
• Design and operate workflow orchestration and integrations across systems.
• Partner closely with various teams to assess and manage security risk across third party relationships.
• Translate ambiguous business and security requirements into practical, scalable program solutions.
• Identify opportunities to automate manual processes across the program.
• Drive program operational excellence by establishing repeatable processes, service-level expectations, metrics, and reporting.
• Evaluate third party security controls, cloud architectures, integration patterns, and risk posture.
• Conduct threat modeling assessments on high-risk integrations.
• Manage and prioritize a portfolio of complex security risk reviews and initiatives.
• Partner with technical teams to implement or optimize systems and tools.
• Develop dashboards, reporting mechanisms, and program insights.
• Act as a trusted advisor and SME on third party security risk management.
• Contribute to the broader Security Risk Management strategy.

Qualifications

• 5+ years of experience in Information Security, Risk Management, Engineering and/or relevant roles.
• Experience performing security due diligence on M&A targets or running third party risk assessments.
• Hands-on experience using agentic coding tools and a working knowledge of Python.
• Familiarity with cloud environments (AWS, GCP, or Azure).
• Excellent written and verbal communications skills.
• Experience engineering solutions via Python or other agentic coding tooling.
• Experience with industry-based information security & control frameworks.
• BA or BS degree in Information Security, Cyber Security, Computer Science or related field.
• Attention to detail and experience with security practices and security tooling.
• Demonstrated ability to drive projects towards completion.
• Ability to understand and communicate technical issues to non-technical teams.
• Sound judgment and discretion handling confidential information.
• Familiarity with international data protection requirements is a plus.
• Professional certification in Information Security or Risk Management is a plus.

Requirements

• Base Pay Grade: L
• Equity Grade: 5
• Base pay range per year: CAD $128,000 - $188,000
• Remote-first with flexibility built in.

Benefits

• Health coverage at no cost: We cover 100% of premiums for employees and their dependents.
• Spending stipends: Monthly stipends support your tech setup and health and wellness options.
• Time off to recharge: Flexible time off and generous holiday calendars.
• Employee stock purchase plan (ESPP) allows you to buy Affirm stock at a discount.

Company Description

We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help.

For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law.