Remote opportunity at
AffirmSecurity Risk Management Lead
Affirm is hiring a Security Risk Management Lead for a full-time position located in Canada, specifically open to applicants residing in Alberta, British Columbia, Manitoba, New…
Career Tools
About This Role
Affirm is hiring a Security Risk Management Lead for a full-time position located in Canada, specifically open to applicants residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan. This role operates on a remote-first basis, though all new hires are invited to attend an in-person onboarding experience. Affirm builds transparent financial products that offer predictable ways for people to pay…
Job Description
Affirm is hiring a Security Risk Management Lead for a full-time position located in Canada, specifically open to applicants residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan. This role operates on a remote-first basis, though all new hires are invited to attend an in-person onboarding experience. Affirm builds transparent financial products that offer predictable ways for people to pay over time without hidden fees.
In this capacity, the Security Risk Management Lead will help drive the transition of security risk management from traditional compliance into an engineering discipline. The successful candidate will design, develop, configure, and implement technical solutions for both the Security Third Party Program and broader risk management functions. Responsibilities include conducting pre-launch security due diligence for international expansion partners, supporting M&A security evaluations, post-close vendor integration, and orchestrating automated workflows using modern tooling and programming languages.
The annual base salary ranges from CAD 128,000 to CAD 188,000, supplemented by equity rewards, monthly health, wellness, and tech stipends, and comprehensive medical, dental, and vision coverage that is fully subsidized for employees and their dependents. Additional perks include flexible time off and an employee stock purchase plan.
Responsibilities
- Lead and mature the Security Third Party Program through process design, implementation, and continuous workflow improvement
- Perform pre-launch security due diligence for third-party entities supporting new international markets such as payment processors, banking partners, credit bureaus, KYC providers, collections agencies, and hosting providers
- Partner with finance, legal, and security leadership to execute M&A security due diligence by evaluating target security programs, control environments, and incident histories
- Manage post-close integration of acquired company vendor portfolios into the existing third-party program
- Design and operate workflow orchestration and integrations across systems like ticketing platforms, GRC tools, and cloud control planes
- Collaborate across procurement, legal, engineering, IT, compliance, and privacy departments to assess and manage third-party security risks
- Identify automation opportunities for manual procedures and build prototype solutions independently
- Establish repeatable processes, metrics, service-level expectations, and reporting mechanisms for third-party risk management
- Evaluate third-party security controls and cloud architectures on AWS or GCP while providing actionable recommendations
- Perform threat modeling assessments on high-risk integrations alongside security subject matter experts
- Manage multiple security risk reviews and confidential deal work concurrently under tight timelines
- Develop custom dashboards, SQL queries, or BI tools to track risk trends and program visibility
Requirements
- Minimum of 5 years of professional experience spanning Information Security, Risk Management, or Engineering
- Demonstrated background conducting M&A security due diligence or running third-party risk assessments across various regulatory regimes
- Hands-on practice using agentic coding utilities including Cursor, Claude Code, and Copilot, combined with working knowledge in Python
- Familiarity with cloud platforms such as AWS, GCP, or Azure, covering IAM, logging, and related security controls
- Strong written and verbal communication abilities
- Familiarity with established information security and control frameworks such as NIST Cybersecurity Framework, ISO 2700x, SOC 1 and 2, PCI DSS, and CIS Critical Security Controls
Qualifications
- Bachelor of Arts or Bachelor of Science degree in Information Security, Cyber Science, Computer Science, or a related field
- Familiarity with international data protection laws and resilience regulations including GDPR and EU DORA
- Professional certification in Information Security or Risk Management such as CISSP, CISM, CISA, or CRISC
Core Skills
Benefits
- Annual base salary range between CAD 128,000 and 188,000
- Equity rewards offered through Affirm Holdings, Inc.
- 100% subsidized medical coverage, dental, and vision for employees and dependents
- Monthly spending stipends for tech setup, health, and wellness choices
- Flexible time off and generous holiday calendar
- Employee stock purchase plan to purchase discounted company stock
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the salary range for this position?
The base pay range for this Canadian role is CAD 128,000 to CAD 188,000 per year, which is part of a total compensation package including equity and stipends.
Is this job remote?
Yes, Affirm is a remote-first company, and this role is open to candidates residing in specific Canadian provinces including Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan.
What experience is required to apply?
Applicants must have at least 5 years of experience in Information Security, Risk Management, Engineering, or relevant roles, along with M&A or third-party assessment experience, familiarity with cloud environments, and working knowledge of Python and agentic coding tools.
What benefits are included?
Affirm provides fully covered medical, dental, and vision premiums for employees and dependents, monthly health and tech stipends, flexible time off, an employee stock purchase plan, and equity rewards.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.