Remote Security Risk Engineer - TPRM & Automation

Affirm; Sioux Falls (SD); On-site; USD 115,000 - 180,000; Full time

Benefits offered by this job

Health care coverage for you andDepend

ESPP

Flexible Spending Wallets

Generous time off

Job summary

Affirm is a remote-first company reinventing credit. We seek a Security Risk Management professional to own third-party risk assessments, automate GRC workflows, and partner with procurement, legal, and engineering.

You will implement risk reviews, build dashboards, and scale the program with Python and agentic coding tools. This role supports transforming security governance into a security engineering discipline.

Qualifications

• 3+ years in information security, risk management, or compliance.
• Familiar with agentic coding tools and Python scripting.
• Experience with cloud security concepts and common frameworks (NIST, ISO 27001, SOC 2, PCI DSS).
• Professional certification or active pursuit (CISSP, CISM, CISA, CRISC) preferred.

Responsibilities

• Conduct third-party security assessments and document findings.
• Develop automation to reduce manual GRC workflows using Python and low-code tools.
• Integrate ticketing, GRC, and vendor platforms to support workflows.
• Collaborate with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews.
• Develop dashboards and metrics for stakeholders to monitor third-party risk posture.
• Contribute to program documentation and process improvements.

Skills

InfoSec experience

Risk management

Python scripting

Agentic coding tools

Education

BA/BS in a relevant field

CISSP/CISM/CISA/CRISC or equivalent

Tools

Cursor

Claude Code

Copilot

Job description

Affirm is a remote-first company reinventing credit. We seek a Security Risk Management professional to own third-party risk assessments, automate GRC workflows, and partner with procurement, legal, and engineering.

You will implement risk reviews, build dashboards, and scale the program with Python and agentic coding tools. This role supports transforming security governance into a security engineering discipline.