Remote Security Risk Engineer – TPRM & Automation

Affirm; Boise (ID); On-site; USD 115,000 - 180,000; Full time

Benefits offered by this job

Health coverage and benefits

Remote-first company

Equity/ESP

Job summary

Affirm is seeking a security risk management professional to evaluate, build, and refine solutions for third-party risk and governance. You will ship automation to replace manual GRC work with code-defined workflows and develop deep expertise in security risk across the program.

The role partners with Procurement, Legal, Engineering, IT, Compliance, and Privacy to review risk, drive actions, and report on risk posture. Remote-friendly and state-based pay scales apply.

Qualifications

• 3+ years of experience in Information Security, Risk Management, Compliance, or related field.
• Familiarity with agentic coding tools and Python scripting/automation.
• Experience with cloud environments (AWS, GCP, or Azure) and cloud security concepts.
• Knowledge of security frameworks (NIST, ISO 27001, SOC 2, PCI DSS).
• Clear written and verbal communication translating risk concepts to diverse audiences.
• Professional certification (CISSP/CISM/CISA/CRISC) or equivalent experience; BA/BS preferred.

Responsibilities

• Conduct third-party security assessments and document risk findings for the TPRM program.
• Build and maintain automation to reduce manual GRC workflows using Python and low-code tools.
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews and actions.
• Develop dashboards and metrics to provide visibility into third-party risk posture.
• Contribute to process improvements and program documentation for security governance.

Skills

InfoSec experience

Python

Security risk management

Technical communication

Education

BA/BS or equivalent

Tools

Cursor

Claude Code

Copilot

Job description

Affirm is seeking a security risk management professional to evaluate, build, and refine solutions for third-party risk and governance. You will ship automation to replace manual GRC work with code-defined workflows and develop deep expertise in security risk across the program.

The role partners with Procurement, Legal, Engineering, IT, Compliance, and Privacy to review risk, drive actions, and report on risk posture. Remote-friendly and state-based pay scales apply.