Remote Security Risk Engineer — Third-Party & Automation

Affirm; Salt Lake City (UT); On-site; USD 115,000 - 165,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is seeking a Security Risk Management Specialist to evaluate and automate third-party risk and governance across the Security program. You will apply policy to vendor decisions and ship code-defined workflows using Python, Cursor, Claude, and other agentic tools, reducing manual GRC work while maturing security engineering practices.

You will partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy to review risk, drive follow-ups, and implement risk-informed decisions.

Qualifications

• 3+ years of experience in Information Security, Risk Management, or Compliance.
• Familiar with agentic coding tools and Python scripting for automation.
• Knowledge of cloud security concepts across AWS, GCP, or Azure.
• Understanding of security frameworks such as NIST, ISO 27001, SOC 2, and PCI DSS.
• Strong written and verbal communication for diverse audiences.
• Pursuing or holding a certification like CISSP/CISM/CISA/CRISC or equivalent experience.

Responsibilities

• Conduct third-party security assessments and document risk findings.
• Build and maintain automation to reduce manual GRC workflows using Python and low-code tools.
• Configure integrations across ticketing, GRC, and vendor management platforms.
• Collaborate with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews.
• Develop dashboards and metrics to visualize third-party risk posture.
• Contribute to process improvements and documentation for security governance.

Skills

Information Security

Risk Management

Compliance

Python scripting

Cloud security

Security frameworks

Communication

Professional certs (CISSP/CISM/CISA/CR

Education

BA/BS in a relevant field

Tools

Cursor

Claude Code

Copilot

Job description

Affirm is seeking a Security Risk Management Specialist to evaluate and automate third-party risk and governance across the Security program. You will apply policy to vendor decisions and ship code-defined workflows using Python, Cursor, Claude, and other agentic tools, reducing manual GRC work while maturing security engineering practices.

You will partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy to review risk, drive follow-ups, and implement risk-informed decisions.