1 day ago
Remote, CanadaSenior
Responsibilities
- Lead the design and operational build-out of insider threat workstreams.
- Create investigative standards, playbooks, operating processes, metrics, and reporting.
- Support insider risk investigations with telemetry and evidence analysis, forensics, written findings, and risk recommendations.
- Partner with Legal, HR/Employee Relations, Privacy, and Compliance on case handling, escalation, privacy, and regulatory obligations.
- Threat model high-risk data and systems and partner with detection engineers to create production detections.
- Own and improve data loss prevention, endpoint monitoring, secure browser, contractor access, SaaS posture management, and access governance controls.
- Automate evidence collection, case routing, reporting, triage, and investigation workflows using Python and workflow automation platforms.
- Build and operate agentic automations for insider risk triage and investigations while defining decisions that require human review.
Requirements
- Deep expertise in security engineering, security operations, insider risk, or digital forensics.
- Experience standing up new security capabilities and running investigations end to end, including evidence handling, log and endpoint forensics, timeline reconstruction, and written findings for Legal and HR audiences.
- Ability to write and evaluate detection logic against endpoint, identity, cloud, and SaaS telemetry in a SIEM such as Splunk, Elastic, Panther, or Chronicle.
- Hands-on experience with insider risk tooling including DLP, UEBA, endpoint detection and response, CASB, and access governance.
- Working knowledge of Python for security tooling and automation.
- Experience building and maintaining production workflows in automation platforms such as Tines or Torq.
- Experience building and running production agentic automations for alert triage and investigation, including LLM-driven enrichment, summarization, or first-pass analysis.
- Discretion, sound judgment, and ability to navigate privacy, legal, and employee-relations considerations.
- Clear written and verbal communication skills and ability to collaborate across Security, Engineering, Legal, HR, Privacy, and Compliance.
- Experience in regulated or financial-services environments, including SOC 2, PCI DSS, or GLBA, is a plus.
Benefits
- Remote-first role open to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan.
- Occasional in-person work may be required, and all new hires are invited to an in-person onboarding experience.
- 100% subsidized medical, dental, and vision coverage for employees and dependents.
- Monthly health, wellness, and technology spending stipends.
- Flexible time off and generous holiday calendars.
- Employee stock purchase plan with discounted Affirm stock.
- Inclusive interview process with accommodations for candidates with disabilities.
About Affirm
Affirm provides buy now, pay later installment financing at online and in-store checkout, along with a consumer app and virtual card, for shoppers and merchants. It monetizes through merchant fees and interest on select loans, with no late fees. Founded in 2012 and headquartered in San Francisco, Affirm is a public company listed on NASDAQ that powers payments for thousands of ecommerce retailers.