Remote Security Risk Engineer, TPRM & Automation

Affirm; Saskatoon; On-site; CAD 101,000 - 151,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is seeking a Security Risk Management Specialist to evaluate, build, and refine solutions for third-party risk within the Security Third Party Program. You will apply security policy to vendor decisions and ship automation using Python and agentic coding tools to replace manual GRC work with scalable workflows.

You will partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy to perform risk reviews, track follow-ups, and report metrics.

Qualifications

• 3+ years of experience in Information Security, Risk Management, Compliance, or a related field.
• Familiarity with agentic coding tools (Cursor, Claude Code, Copilot) and Python scripting.
• Working knowledge of cloud environments (AWS, GCP, Azure) and cloud security concepts.
• Knowledge of security frameworks such as NIST, ISO 27001, SOC 2, PCI DSS.

Responsibilities

• Scale Affirm's Third Party Risk Management program through process rigor, hands-on automation, and cross-functional partnership.
• Conduct third-party security assessments, review vendor questionnaires, evaluate controls, and document risk findings.
• Build and maintain automation to reduce manual GRC workflows using Python and low-code tools.
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on third-party risk reviews and follow-up actions.
• Develop dashboards, metrics, and reporting to provide visibility into risk posture.

Skills

Information security

Risk management

Communication

Cloud security concepts

Education

BA/BS in a relevant field

Tools

Cursor

Claude Code

Copilot

Job description

Affirm is seeking a Security Risk Management Specialist to evaluate, build, and refine solutions for third-party risk within the Security Third Party Program. You will apply security policy to vendor decisions and ship automation using Python and agentic coding tools to replace manual GRC work with scalable workflows.

You will partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy to perform risk reviews, track follow-ups, and report metrics.