Security Risk Engineer II — TPRM Automation (Remote)

Affirm; Halifax; On-site; CAD 101,000 - 151,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off and holidays

Employee stock purchase plan

Job summary

Affirm, a company reinventing credit with customer-first security, seeks a Security Risk Management Specialist to scale its Third Party Risk Management program. The role blends policy application with automation using Python, Cursor, Claude, and other agentic tools to replace manual GRC work with code-defined workflows.

You will partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy to perform risk reviews, develop dashboards, and drive risk-informed decisions, helping

Qualifications

• 3+ years of experience in Information Security, Risk Management, Compliance, or a related field.

Responsibilities

• Conduct third-party security assessments, reviewing vendor questionnaires, evaluating security controls, and documenting risk findings.
• Build and maintain automation to reduce manual GRC workflows using Python, low-code platforms, and agentic coding tools.
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms to support repeatable workflows.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on third-party risk reviews and risk-informed actions.
• Develop dashboards, metrics, and reporting to give stakeholders visibility into third-party risk posture.
• Contribute to process improvements and program documentation to mature affirm's security governance over time.

Skills

Information Security

Risk Management

Policy & Compliance

Python scripting

Cloud security

Education

BA/BS in a relevant field

Professional certification (CISSP/CISM/CISA/CRISC) or equivalent

Tools

Cursor

Claude Code

Copilot

Job description

Affirm, a company reinventing credit with customer-first security, seeks a Security Risk Management Specialist to scale its Third Party Risk Management program. The role blends policy application with automation using Python, Cursor, Claude, and other agentic tools to replace manual GRC work with code-defined workflows.

You will partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy to perform risk reviews, develop dashboards, and drive risk-informed decisions, helping