The opportunity
At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most.
What you'll do
Lead security incidents and investigations across the full lifecycle, from: initial assessment through containment, remediation, recovery, and post-incident review.
Serve as incident commander for major security events, set clear roles and: decision paths, and coordinate large technical and cross-functional response groups through ambiguity.
Guide technical investigations and root-cause analyses with engineering: teams, validate fixes, and drive durable corrective actions across the business.
Manage and develop a technical, engineering-oriented response team, set: priorities, coach engineers, and build incident command depth and consistent execution across regions.
Set operating objectives and global readiness practices, including playbooks,: escalation paths, exercises, on-call readiness, postmortems, and measures of response effectiveness.
Drive engineering improvements to response tooling, security telemetry,: detection, and automation, including agentic AI workflows that support investigation and analysis with appropriate human oversight and security and privacy safeguards.
What they're looking for
- Translate complex security and incident metrics into actionable executive: dashboards and board-level risk reporting, surfacing trends and remediation priorities that drive cross-functional action.
- + years of experience in security operations, incident response, or a related security field.
- Proven ability to lead major security incidents and investigations in: technology-driven, cloud-native environments, from detection and assessment through containment, remediation, and recovery.
- Strong technical foundation in security operations, with depth in: investigations, incident response, detection, root-cause analysis, and/or digital forensics across cloud and enterprise environments. Experience in fintech or payments, and familiarity with using threat intelligence to inform response, are nice to have.
