Senior Information Security Manager, AffiniPay

• 6+ years of progressive experience in information security, cybersecurity engineering, or security risk management
• Proven ability to operationalize controls under PCI DSS, SOC 2 Type 2, or similar regulatory frameworks, with audit support and remediation tracking
• Demonstrated ownership of InfoSec risk identification, analysis, and mitigation, with ability to drive collaborative treatment planning across stakeholders
• Hands-on experience with cloud security architecture (AWS required), including IAM, logging, encryption, GuardDuty, Security Hub, and Terraform-based infrastructure
• Familiarity with security platform management and tuning, including CrowdStrike, Vanta, and Snyk, and comfort leading tool implementation and maturity roadmaps
• Experience building and maintaining department-level metrics or KPIs tied to security program performance or audit readiness
• Ability to translate technical risk into business impact and present findings to stakeholders
• Track record of influencing cross-functional teams without direct authority and delivering on cross-team security initiatives
• Experience evaluating or deploying AI- or ML-enhanced platforms in the security, compliance, or detection space (e.g., CrowdStrike, Vanta, Snyk)
• Demonstrated ability to identify automation or AI opportunities to reduce manual workflows, improve detection, or accelerate compliance assurance
• Comfort working with technical teams on AI/LLM integrations, anomaly detection enhancements, or AI-powered reporting

Desirable

• Own the implementation, configuration, and operationalization of information security platforms (e.g., CrowdStrike, Security Hub, GuardDuty, Vanta, DataGrail)
• Ensure CrowdStrike and similar tools are correctly configured and deployed, in partnership with the Information Security Engineer, to achieve intended coverage and effectiveness
• Lead monitoring, tuning, and stakeholder engagement for suspicious findings or platform alerts, ensuring clear triage and response workflows
• Oversee the security posture for access controls, logging, and backups, ensuring relevant data is collected and ingested into NG SIEM or other detection pipelines
• Track the effectiveness of tooling, identify opportunities to improve alert fidelity, and eliminate coverage gaps
• Evaluate opportunities to increase automation and efficiency through AI capabilities within existing tools (e.g., CrowdStrike, Vanta, Snyk) and recommend adoption of new platforms that align with our AI growth goals
• Lead experimentation or pilot efforts to improve security signal triage, anomaly detection, and risk prediction through AI/ML-powered capabilities
• Own the identification, evaluation, and documentation of security-related risks across infrastructure, applications, and third-party services
• Develop and maintain actionable risk treatment plans in collaboration with stakeholders, balancing mitigation, acceptance, and investment tradeoffs
• Partner with the VP of Information Security to maintain visibility into top risks, contribute to executive-level risk dashboards, and align controls to actual exposure
• Ensure that AffiniPay’s cloud environments (AWS, Terraform-managed infrastructure) meet commercial security best practices and evolving compliance obligations
• Partner with Infrastructure, DevOps, and DevX to assess and remediate gaps in governance, process documentation, or control ownership
• Drive alignment around security configurations, automation guardrails, and baseline control requirements across brands
• Own security control operations for frameworks, including SOC 2 Type 2, PCI DSS 4.0, and other in-scope privacy obligations
• Ensure evidence collection, documentation, and audit support are proactively maintained
• Maintain clear ownership of control domains, including logging, monitoring, asset management, backup validation, encryption, and vendor risk support
• Build and maintain repeatable, data-driven security metrics and KPIs at the team, department, and executive levels
• Identify or implement tools and workflows to assist in automated data gathering, reporting, and visualization
• Use metrics to support risk reduction decisions, program transparency, and budget justification for future investment
• Contribute to company-wide AI metrics by helping establish security-specific AI adoption benchmarks, efficiency gains, or automation outcomes related to platform usage and team productivity
• Support incident response preparation through tabletop exercises, playbook development, and role clarity across functions
• Partner with Engineering and business stakeholders to triage alerts, classify severity, and coordinate cross-team responses
• Maintain ownership of detection platforms and ensure findings are actionable, prioritized, and communicated to the appropriate teams
• Provide guidance, support, and tactical leadership to Information Security Engineers and Compliance staff
• Serve as a point of contact across departments, building trust and driving execution without escalation
• Help build bench strength and resiliency across the InfoSec function by identifying training needs, process gaps, and staffing signals

• All interviews take place over phone call, Zoom/Google Meet or in person
• All offers are communicated verbally by our Talent Acquisition Specialists with a written offer letter as a follow up