Remote Security Risk Management Specialist II

Affirm; San Francisco (CA); On-site; USD 130,000 - 180,000; Full time

Benefits offered by this job

Remote‑first culture

Health insurance

Equity / ESPP

Job summary

Affirm is a remote‑first company reinventing credit. We seek a Security Risk Management Specialist to assess third‑party risk, automate GRC workflows, and partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy to inform risk decisions.

You will build scalable, code‑defined workflows using Python and agentic tools, mapping security policy to real vendor decisions while maturing our security engineering discipline.

Qualifications

• 3+ years in information security, risk management, or a related field.
• Familiar with cloud security concepts and common frameworks (NIST, ISO 27001, SOC 2, PCI DSS).
• Experience with scripting in Python and agentic coding tools (Cursor, Claude Code, Copilot).
• Ability to translate security risk concepts for technical and non-technical audiences.

Responsibilities

• Conduct third‑party security assessments and document risk findings for the TPRM program.
• Develop and maintain automation to reduce manual GRC workflows using Python and low‑code tools.
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews and action follow‑ups.
• Develop dashboards and reports to provide visibility into third‑party risk posture.
• Contribute to process improvements and program documentation.

Skills

Information security

Risk management

Compliance

Python scripting

Agentic coding tools

Education

BA/BS in a relevant field or equivalent experience

Tools

Cursor

Claude Code

Copilot

Python

Job description

Affirm is a remote‑first company reinventing credit. We seek a Security Risk Management Specialist to assess third‑party risk, automate GRC workflows, and partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy to inform risk decisions.

You will build scalable, code‑defined workflows using Python and agentic tools, mapping security policy to real vendor decisions while maturing our security engineering discipline.