Remote Security Risk Engineer — Third-Party Programs

Affirm; Pittsburgh (Allegheny County); On-site; USD 115,000 - 180,000; Full time

Benefits offered by this job

Health coverage

Flexible Spending Wallets

Paid time off

ESPP

Job summary

Affirm is a remote‑first company redefining credit risk management. The Security Risk Management Specialist will evaluate, automate, and refine third‑party risk processes across the Security Third Party Program, partnering with Procurement, Legal, and Engineering to scale governance.

You’ll implement code‑defined workflows using Python and agentic tooling, develop dashboards, and drive risk‑based decisions in a fast‑moving security engineering environment.

Qualifications

• 3+ years of experience in Information Security, Risk Management, Compliance, or related field.
• Familiar with agentic coding tools and Python scripting for automation.
• Familiar with cloud environments (AWS, GCP, or Azure) and cloud security concepts.
• Knowledge of security frameworks such as NIST, ISO 27001, SOC 2, PCI DSS.
• Strong written and verbal communication; able to translate risk for technical and non-technical audiences.
• Holding or pursuing CISSP, CISM, CISA, or CRISC; BA/BS preferred.

Responsibilities

• Conduct third‑party security assessments and document risk findings for TPRM program.
• Build and maintain automation to reduce manual GRC workflows.
• Configure integrations across ticketing, GRC, and vendor management platforms.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews.
• Develop dashboards and reporting for visibility into third‑party risk posture.
• Contribute to process improvements and program documentation.

Skills

Information Security

Risk Management

Compliance

Cloud security

Communication

Education

BA/BS in relevant field

Professional certification (preferred)

Tools

Cursor

Claude Code

Copilot

Python

Job description

Affirm is a remote‑first company redefining credit risk management. The Security Risk Management Specialist will evaluate, automate, and refine third‑party risk processes across the Security Third Party Program, partnering with Procurement, Legal, and Engineering to scale governance.

You’ll implement code‑defined workflows using Python and agentic tooling, develop dashboards, and drive risk‑based decisions in a fast‑moving security engineering environment.