Security Risk Management Lead

🔥 18 minutes ago

🇨🇦 Canada – Remote

💵 $128k - $188k / year

⏰ Full Time

🟠 Senior

🔒 Insurance

👻 Ghost score 1%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Affirm

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2012

💳 Fintech

👥 B2C

🛍️ eCommerce

💰 Post-IPO Equity on 2021-01

Fintech • B2C • eCommerce

Affirm is a financial technology company that offers a 'Buy Now, Pay Later' service, allowing consumers to make purchases and pay for them over time with flexible payment plans. Affirm eliminates hidden fees and compound interest, providing clear terms and conditions for its users. The company also offers the Affirm Card, a debit card that allows users to request to pay over time for larger purchases or pay in full for smaller ones. Affirm partners with various retailers across multiple categories, including electronics, apparel, and travel, providing customers with the convenience of paying over time at checkout both online and in physical stores. Affirm's services are integrated with Apple Pay, enabling customers to make payments seamlessly from their iPhone or iPad.

📋 Description

• Lead and mature Affirm's Security Third Party Program, including processes, controls, and operational workflows • Own pre-launch security due diligence for third parties supporting entry into new international markets • Adapt third party assessment standards for data residency, cross-border data transfer, and local regulatory requirements • Support M&A security due diligence by assessing acquisition targets' security programs, controls, incident history, data handling, and third party dependencies • Lead post-close integration of acquired companies' vendor portfolios into Affirm's third party program • Design and operate workflow orchestration and integrations across ticketing, GRC, vendor management, identity, and cloud systems • Partner with Procurement, Legal, Engineering, IT, Compliance, Privacy, Corporate Development, international launch teams, and business stakeholders • Translate ambiguous business and security requirements into scalable program solutions and decision frameworks • Automate manual processes and prototype solutions using modern tooling • Establish repeatable processes, service-level expectations, metrics, and reporting • Evaluate third party security controls, AWS/GCP cloud architectures, integration patterns, and risk posture • Conduct threat modeling assessments on high-risk integrations • Manage and prioritize complex security risk reviews and initiatives, including confidential deal work • Develop dashboards, reporting mechanisms, and program insights using SQL, BI tools, or custom tooling • Act as a trusted advisor and subject matter expert on third party security risk management • Contribute to Security Risk Management strategy by scaling and strengthening security governance through engineering

🎯 Requirements

• 5+ years of experience in Information Security, Risk Management, Engineering and/or relevant roles • Experience performing security due diligence on M&A targets, or running third party risk assessments across multiple countries or regulatory regimes • Hands-on experience using agentic coding tools such as Cursor, Claude Code, and Copilot • Working knowledge of Python sufficient to read, modify, and run scripts, build automations, and ship small tools end-to-end • Familiarity with AWS, GCP, or Azure, including IAM, logging, common services, and cloud security risks and controls • Experience engineering solutions via Python, Claude, Cursor, or other agentic coding tooling • Experience with information security and control frameworks including NIST Cybersecurity Framework, ISO 2700x, SOC 1 & 2 (SSAE 18), ISAE 3402, PCI DSS, NIST 800-53, and CIS Critical Security Controls • BA or BS degree in Information Security, Cyber Security, Computer Science, or related field, or commensurate experience • Experience with security practices and security tooling • Demonstrated ability to drive projects toward completion • Ability to communicate technical issues to non-technical teams and leadership • Sound judgment and discretion handling confidential, deal-sensitive information • Familiarity with international data protection and third party or operational resilience requirements is a plus • Professional certification in Information Security or Risk Management, such as CISSP, CISM, CISA, or CRISC, is a plus • Excellent written and verbal communication skills

🏖️ Benefits

• 100% subsidized medical coverage for employees and dependents • Dental and vision coverage for employees and dependents • Monthly tech setup spending stipend • Monthly health and wellness spending stipends • Flexible time off • Generous holiday calendars • Employee stock purchase plan (ESPP) allowing employees to buy Affirm stock at a discount • Remote-first work flexibility • In-person onboarding experience for all new hires • Inclusive interview process and accommodations for candidates with disabilities