Security Risk Management Lead (Fintech)

Location: Remote in Canada; open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan. Occasional in-person work at an Affirm office and in-person onboarding may be required.

Base pay: CAD $128,000–$188,000 per year.

Company

Affirm develops financial products that provide a clear and predictable way for people to pay over time without hidden fees.

What you will do

• Lead and mature the Security Third Party Program by designing, implementing, and improving processes, controls, workflows, service-level expectations, metrics, and reporting.
• Own pre-launch security due diligence for third parties supporting international market entry, including payment processors, banking and lending partners, credit bureaus, identity verification and KYC providers, collections agencies, and regional hosting providers.
• Assess data residency, cross-border data transfers, local regulatory requirements, cloud architectures, integration patterns, and third-party security controls.
• Support M&A security due diligence by evaluating acquisition targets’ security programs, controls, incident history, data handling, and third-party dependencies, then producing risk ratings and deal recommendations.
• Lead post-close integration of acquired vendor portfolios, including inventory, risk tiering, reassessment, remediation tracking, and transition service dependencies.
• Design workflow orchestration, system integrations, dashboards, reporting, and custom tooling across ticketing, GRC, vendor management, identity, cloud, SQL, and BI systems; collaborate with Procurement, Legal, Engineering, IT, Compliance, Privacy, Corporate Development, international launch teams, and business stakeholders.

Requirements

• 5+ years of experience in Information Security, Risk Management, Engineering, or relevant roles.
• Experience with M&A security due diligence or third-party risk assessments across multiple countries or regulatory regimes.
• Hands-on experience with agentic coding tools such as Cursor, Claude Code, or Copilot, plus working knowledge of Python sufficient to read, modify, and run scripts, build automations, and ship small tools end-to-end.
• Experience engineering solutions using Python, Claude, Cursor, or other agentic coding tools.
• Familiarity with AWS, GCP, or Azure, including IAM, logging, common services, and cloud security risks and controls.
• Experience with information security and control frameworks such as NIST Cybersecurity Framework, ISO 2700x, SOC 1 and 2 (SSAE 18), ISAE 3402, PCI DSS, NIST 800-53, and CIS Critical Security Controls.
• BA or BS in Information Security, Cyber Security, Computer Science, or a related field, or commensurate experience.
• Excellent written and verbal communication skills, attention to detail, security practices and tooling experience, and demonstrated ability to drive projects to completion.
• Ability to communicate technical issues to non-technical teams and leadership, with sound judgment and discretion when handling confidential, deal-sensitive information.

Nice to have

• Familiarity with international data protection and third-party or operational resilience requirements, such as GDPR and EU DORA.
• Professional certification in Information Security or Risk Management, such as CISSP, CISM, CISA, or CRISC.

Culture & Benefits

• Remote-first work with flexibility within the country of employment.
• 100% subsidized medical, dental, and vision coverage for employees and dependents.
• Monthly stipends for technology, health, and wellness spending.
• Flexible time off and generous holiday calendars.
• Employee stock purchase plan with discounted Affirm stock.
• Inclusive interview process with accommodations available for candidates with disabilities.