Director, Affirm Bank Information Security at Affirm

This is a high-stakes leadership role for a heavy hitter in the FinTech or banking security space. You are likely a seasoned security executive with over 10 yea

Work type: remote

Location: Remote US

Salary: $300,000 – $360,000/yr

Type: Full-time

Summary

This is a high-stakes leadership role for a heavy hitter in the FinTech or banking security space. You are likely a seasoned security executive with over 10 years of experience, specifically within regulated financial institutions. Since this role involves launching a *de novo* bank (a brand-new entity), the ideal candidate is someone who thrives in "build mode"—capable of designing enterprise-level security architecture, navigating FDIC/FFIEC audits, and building a team from the ground up. The compensation is highly competitive, starting at **$300k–$360k base** (depending on location), plus equity and 100% employer-paid health premiums. As a **remote-first** position, it offers significant geographic flexibility while placing you at the executive table of a major financial disruptor. You aren't just maintaining a program; you are the architect of a new bank’s entire security posture. **You might be a good fit if you:** * Have 5+ years of leadership experience and have survived rigorous FDIC or state regulatory examinations. * Are an expert in GLBA, third-party risk management, and cloud-based security operations. * Love the challenge of building a security program from scratch rather than just managing an existing one. * Can translate complex cyber threats into clear, risk-based strategic advice for a Board of Directors.

Job Description

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest.

The Chief Information Security Officer (CISO) will serve as a key member of the Bank’s Executive Management Team and will be responsible for establishing and leading Bank’s information security and cybersecurity programs. As the Bank prepares to launch as a de novo Industrial Loan Company (ILC), the CISO will design and implement an enterprise-wide security framework that meets FDIC and state regulatory expectations, supports the Bank’s risk appetite, and protects customer and institutional data.

The CISO will lead the development of information security governance, technical controls, and third-party risk oversight, ensuring a strong and scalable security posture from inception through growth. This leader will collaborate closely with technology, risk, and operations teams to ensure security is integrated into every aspect of the Bank’s systems and operations.

What You’ll Do

1. Information Security Program Development

• Design, implement, and maintain a comprehensive Information Security Program consistent with FDIC guidance (e.g., FIL-66-2019, FIL-13-2021) and the Interagency Guidelines Establishing Information Security Standards.

• Develop and oversee policies, standards, and procedures governing cybersecurity, data protection, and incident response.

• Ensure alignment with the Bank’s overall risk management and governance frameworks.

• Provide regular reporting to executive management and the Board on the Bank’s security posture, emerging risks, and mitigation efforts.

• Establish and manage a threat monitoring and detection capability to identify, assess, and respond to cybersecurity risks.

• Oversee implementation of layered security controls (e.g., network segmentation, encryption, access controls, endpoint protection, vulnerability management).

• Lead the Bank’s Incident Response Program, ensuring timely escalation and coordination with regulators when required.

• Maintain relationships with information-sharing groups (e.g., FS-ISAC) and law enforcement to stay informed of emerging threats.

• Evaluate the information security posture of third-party and affiliate service providers in accordance with the Bank’s Vendor Management Program and FDIC third-party risk guidance.

• Establish due diligence, ongoing monitoring, and contractual requirements for vendors handling sensitive data or performing critical services.

• Coordinate with Operations, Compliance, and Internal Audit to ensure third-party risks are identified, assessed, and mitigated.

• Ensure compliance with applicable privacy and data protection requirements (e.g., GLBA, Regulation P, state privacy laws).

• Implement processes to safeguard customer information and prevent unauthorized access, disclosure, or misuse.

• Partner with business and technology teams to integrate privacy-by-design principles into new products and services.

• Lead development and testing of the Bank’s Business Continuity and Disaster Recovery (BC/DR) plans, ensuring they are integrated with information security objectives.

• Coordinate regular testing and simulations to validate readiness for cyber incidents and system disruptions.

• Support resilience planning for key systems, vendors, and communication protocols.

• Build and document the Bank’s information security program as part of the de novo application process.

• Establish security architecture, monitoring tools, and vendor relationships prior to launch.

• Prepare readiness materials for FDIC and state examinations related to cybersecurity and operational resilience.

• Ensure security risk assessments and third-party reviews are completed and incorporated into pre-opening milestones.

• Serve as the Bank’s senior advocate for cybersecurity and data protection, promoting a culture of security awareness and accountability.

• Provide training and guidance across the organization to enhance information security awareness.

• Collaborate with peers in Risk, Compliance, Operations, and Technology to align security priorities with business strategy.

• Build and lead a capable, mission-driven security team to support the Bank’s evolving needs.

• Minimum of 10 years of information security and technology risk management experience, with at least 5 years in a leadership capacity at a regulated financial institution or Fintech.

• Demonstrated experience designing and implementing information security programs compliant with FDIC and FFIEC standards.

• Strong familiarity with third-party risk frameworks and financial services cybersecurity expectations.

• Experience leading incident response, penetration testing, and security operations in cloud-based and hybrid environments.

• Proven ability to communicate complex technical topics to executive leadership, the Board, and regulators.

• Strong leadership, analytical, and problem-solving skills with a risk-based and pragmatic approach to decision-making.

• Expert knowledge of information security principles, frameworks, and regulatory requirements.

• Strategic thinker with strong operational execution and control discipline.

• Effective communicator capable of influencing across technical and business functions.

• Collaborative leader who fosters a culture of accountability, awareness, and continuous improvement.

At Affirm, we live by our values: People Come First, No Fine Print, It’s On Us, Simplify, and Push the Envelope. As CCO, you will embody these principles while building the foundation of Affirm Bank as a trusted, transparent, and innovative financial institution.

Compensation & BenefitsBase Pay Grade- TEquity Grade- 14

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).

USA Pacific base pay range (CA, WA, NY, NJ, CT) per year: $300,000 - $360,000

USA Sapphire base pay range (all other U.S. states) per year: $267,000 - $327,000

Please note that visa sponsorship is not available for this position.

#LI-Remote

Affirm is proud to be a remote-first company! The majority of our roles are remote and you can work almost anywhere within the country of employment. Affirmers in proximal roles have the flexibility to work remotely, but will occasionally be required to work out of their assigned Affirm office. A limited number of roles remain office-based due to the nature of their job responsibilities.

We’re extremely proud to offer competitive benefits that are anchored to our core value of people come first. Some key highlights of our benefits package include:

• Health care coverage - Affirm covers all premiums for all levels of coverage for you and your dependents

• Flexible Spending Wallets - generous stipends for spending on Technology, Food, various Lifestyle needs, and family forming expenses

• Time off - competitive vacation and holiday schedules allowing you to take time off to rest and recharge

• ESPP - An employee stock purchase plan enabling you to buy shares of Affirm at a discount

[For U.S. positions that could be performed in Los Angeles or San Francisco] Pursuant to the San Francisco Fair Chance Ordinance and Los Angeles Fair Chance Initiative for Hiring Ordinance, Affirm will consider for employment qualified applicants with arrest and conviction records.

By clicking "Submit Application," you acknowledge that you have read Affirm's [Global Candidate Privacy Notice](https://www.affirm.com/global-candidate-privacy-notice) and hereby freely and unambiguously give informed consent to the collection, processing, use, and storage of your personal information as described therein.

View this job on nocollar jobs