Security Risk Management Lead

This is a fully remote position, open to applicants in Canada.

📋 Description

• Lead and enhance Affirm's Security Third Party Program, encompassing processes, controls, and operational workflows.

• Take ownership of pre-launch security due diligence for third parties assisting in entry into new international markets.

• Modify third party assessment standards to address data residency, cross-border data transfer, and local regulatory requirements.

• Facilitate M&A security due diligence by evaluating the security programs, controls, incident history, data handling, and third party dependencies of acquisition targets.

• Oversee the post-close integration of the vendor portfolios of acquired companies into Affirm's third party program.

• Design and manage workflow orchestration and integrations across ticketing, GRC, vendor management, identity, and cloud systems.

• Collaborate with Procurement, Legal, Engineering, IT, Compliance, Privacy, Corporate Development, international launch teams, and business stakeholders.

• Convert ambiguous business and security requirements into scalable program solutions and decision-making frameworks.

• Automate manual processes and prototype solutions utilizing modern tools.

• Establish repeatable processes, service-level expectations, metrics, and reporting.

• Assess third party security controls, AWS/GCP cloud architectures, integration patterns, and risk posture.

• Conduct threat modeling assessments for high-risk integrations.

• Manage and prioritize intricate security risk reviews and initiatives, including confidential deal work.

• Develop dashboards, reporting mechanisms, and program insights through SQL, BI tools, or custom tooling.

• Serve as a trusted advisor and subject matter expert on third party security risk management.

• Contribute to the Security Risk Management strategy by expanding and reinforcing security governance through engineering.

⛳️ Requirements

• 5+ years of experience in Information Security, Risk Management, Engineering, or related fields.

• Proficient in performing security due diligence on M&A targets or conducting third party risk assessments across various countries or regulatory environments.

• Practical experience with agentic coding tools such as Cursor, Claude Code, and Copilot.

• Working knowledge of Python adequate for reading, modifying, and executing scripts, building automations, and deploying small tools from start to finish.

• Familiarity with AWS, GCP, or Azure, including IAM, logging, common services, and cloud security risks and controls.

• Experience in engineering solutions using Python, Claude, Cursor, or other agentic coding tools.

• Knowledge of information security and control frameworks including NIST Cybersecurity Framework, ISO 2700x, SOC 1 & 2 (SSAE 18), ISAE 3402, PCI DSS, NIST 800-53, and CIS Critical Security Controls.

• BA or BS degree in Information Security, Cyber Security, Computer Science, or a related field, or equivalent experience.

• Experience with security practices and security tooling.

• Proven ability to drive projects to completion.

• Capability to communicate technical matters to non-technical teams and leadership.

• Sound judgment and discretion in handling confidential, deal-sensitive information.

• Familiarity with international data protection and third party or operational resilience requirements is a plus.

• Professional certification in Information Security or Risk Management, such as CISSP, CISM, CISA, or CRISC, is a plus.

• Excellent written and verbal communication skills.

🏝️ Benefits

• 100% subsidized medical coverage for employees and their dependents.

• Dental and vision coverage for employees and their dependents.

• Monthly stipend for tech setup expenses.

• Monthly stipends for health and wellness expenses.

• Flexible time off policy.

• Generous holiday calendar.

• Employee stock purchase plan (ESPP) allowing employees to purchase Affirm stock at a discounted rate.

• Remote-first work flexibility.

• In-person onboarding experience for all new hires.

• Inclusive interview process with accommodations for candidates with disabilities.