Remote TPRM Security Risk Engineer

Affirm; St. Louis (MO); On-site; USD 115,000 - 165,000; Full time

Benefits offered by this job

Health coverage

Dental & vision

ESPP

Remote-friendly

Job summary

Affirm is redefining credit with a remote-first culture and a security program transitioning from compliance to engineering-focused governance. We seek a candidate to evaluate third-party risk, automate GRC workflows, and drive data-driven risk decisions across Procurement, Legal, Engineering, and Privacy.

You will design scalable, code-defined workflows using Python and agentic tools, while building deep expertise in security risk and vendor programs.

Qualifications

• 3+ years in Information Security, Risk Management, Compliance, or a related field.
• Proficient with agentic coding tools (Cursor, Claude Code, Copilot) and Python scripting.
• Familiar with cloud environments (AWS, GCP, or Azure) and cloud security concepts.
• Knowledge of NIST, ISO 27001, SOC 2, and PCI DSS.
• Clear written and verbal communication; translate risk for technical and non-technical audiences.
• Working toward or holding CISSP, CISM, CISA, or CRISC; BA/BS preferred.

Responsibilities

• Conduct third-party security assessments and document risk findings for Affirm's TPRM.
• Build and maintain automation to reduce manual GRC workflows using Python and low-code tools.
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews and actions.
• Develop dashboards, metrics, and reporting for visibility into third-party risk posture.
• Contribute to process improvements and program documentation to mature security governance.

Skills

Python

GRC automation

Security risk

Communication

Education

BA/BS in a relevant field

Tools

Cursor

Claude Code

Copilot

AWS

GCP

Azure

NIST

ISO 27001

SOC 2

PCI DSS

Job description

Affirm is redefining credit with a remote-first culture and a security program transitioning from compliance to engineering-focused governance. We seek a candidate to evaluate third-party risk, automate GRC workflows, and drive data-driven risk decisions across Procurement, Legal, Engineering, and Privacy.

You will design scalable, code-defined workflows using Python and agentic tools, while building deep expertise in security risk and vendor programs.