Senior Manager, Security Awareness Program Manager

Affirm values security as being critical to the company’s continued success. Our mission is to cultivate a culture of security at Affirm, enabling the company to succeed in building honest financial products. The Security Risk Management team builds and deploys common governance, risk, and compliance processes and controls, conducts audits, and ensures that technologies and business processes are built with data protection and compliance in mind.

What you'll do

• Design & manage Affirm’s Security awareness campaigns which meet all industry regulations, standards, and compliance requirements.
• Drive a culture of security awareness within the organization by providing security training and guidance to staff on cybersecurity best practices.
• Own all security communications to internal stakeholders & Affirm customers
• Partner with Security, Product, & Eng teams on building better consumer Security content within the Affirm App
• Create and drive engaging and informative security awareness materials such as newsletters, emails, videos, webinars, and training modules 
• Ability to fluently communicate security risks to non-experts to empower business decisions with valuable, actionable information
• Develop, curate, and disseminate security documentation, ensuring awareness amongst stakeholders and employees
• Build & Manage a Security Guidance Hub aiming to provide consistent, actionable, self-service security guidance to engineers, product teams, operations and others
• Partner with Product Security and enhance the current Security Champions program
• Create a metrics framework that can effectively measure Security Awareness

What we look for

• Crystal clear verbal and written communication—people love how your materials and documentation tell them exactly what they need to know so they act in a secure manner, reducing risk to our organization.
• Proven experience in a similar role developing and implementing security awareness programs.
• 8-10 years of risk management, information security, or other relevant experience working with technical teams and balancing risk against business need.
• Experience with e-learning platforms and creating engaging training materials
• Excellent project management and collaboration skills—setting goals and priorities, taking into account dependencies, and handling execution from start to finish.
• A drive to solve difficult problems and evolve the status quo with technical and non-technical solutions—-you’re never satisfied by just ticking a box.
• Passion for working with diverse teams and taking into account each perspective, e.g. as an auditor, engineer, business person, and more.
• Knowledge of risk and control frameworks (e.g. NIST Cyber Security Framework, ISO 2700x, SOC1 & 2 (SSAE18), PCI DSS, NIST-800-53,, SANS Top 20, etc.) and experience with security practices and solutions.

Last updated on Aug 22, 2024