Listing Description

Do you value security as being critical to the company’s continued success? Our mission is to champion a culture of security at Affirm, enabling the company to succeed in building transparent financial products. The Platform Security program is the foundation of both preventive and adaptable security practices to protect Affirm’s assets deployed in the cloud from an adverse event. We partner with key business leaders, project, and integration teams to ensure that the applications running on the cloud platform/infrastructure are secure and resilient.

What You'll Do

• Design/build/operate cloud security solutions that protect infrastructure and applications against potential and ongoing security threats.


• Establish secure cloud-native applications, platforms, core services and security controls across multiple public and private cloud environments including AWS, Azure, GCP.


• Participate, lead and jointly deliver security evaluation reports on cloud providers, cloud native platforms, and Software as a Service solutions.


• Evolve and maintain strong working relationships with multiple internal engineering groups to maintain alignment on technical design strategies.


• Develop security processes and procedures, security configuration, and define service-level agreements and operation standards to guarantee that security controls are managed and maintained.


• Build, validate, and enforce baseline security configurations for operating systems, PaaS, SaaS and cloud environments.

What We Look For

• Bachelor's or Master’s degree from an accredited college/university


• Minimum 5 years of deep technical expertise across multiple technical domains (cloud computing, security, identity and access management, IT infrastructure


• Professional certification (one or more required) - CCSP or CCSK, Cloud Platform and Infrastructure, AWS Certified Solutions Architect, AWS Security Practitioner.


• Experience writing infrastructure as code with Terraform, CloudFormation or AWS CDK . As well as experience with containers and container orchestration (Docker, Podman, Kubernetes, etc.)


• 5 years previous experience implementing CI/CD pipelines in DevSecOps environments. As well as tools enabling automated workflows


• Proven ability to communicate complex subjects regarding strategic and tactical cybersecurity processes to partners of varying technical levels.


• Attention to detail and demonstrated ability to drive projects towards completion within minimal direction.


• Ability to understand and communicate technical issues to non-technical teams. As well as work in a highly matrixed environment and influence teams through gathering consensus.


• Strong understanding of advanced persistent threats, attacker methodologies, attack lifecycle, cyber kill chain, diamond modeling and the MITRE framework.

Location - Remote U.S.

Grade - USA32

#LI-Remote