Security Risk Engineer II: Third-Party Risk & Automation

Affirm; New York (NY); On-site; USD 130,000 - 180,000; Full time

Benefits offered by this job

Health coverage

Equity rewards

Tech stipends

Job summary

Affirm is seeking a Security Risk Management professional to evaluate third-party risk and governance challenges across the program, applying policy to vendor decisions and shipping automation using Python and agentic coding platforms.

The role partners with Procurement, Legal, Engineering, IT, Compliance and Privacy to drive risk reviews, dashboards, and actionable insights while maturing Affirm's security governance from a compliance focus to a security engineering discipline.

Qualifications

• 3+ years of experience in Information Security, Risk Management, Compliance, or a related field.
• Working knowledge of Python for scripting or automation.
• Familiarity with cloud environments and cloud security concepts.
• Knowledge of security frameworks such as NIST, ISO 27001, SOC 2, and PCI DSS.
• Clear written and verbal communication; ability to translate security concepts for diverse audiences.
• Professional certification (CISSP, CISM, CISA, CRISC) or equivalent experience; BA/BS preferred.

Responsibilities

• Conduct third-party security assessments and document risk findings for the TPRM program.
• Build and maintain automation to reduce manual GRC workflows using Python and agentic tools.
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews and actions.
• Develop dashboards, metrics, and reports to provide visibility into third-party risk posture.
• Contribute to process improvements and program documentation to mature security governance.

Skills

Information security

Python

Cloud security

GRC basics

Communication

Education

BA/BS in a relevant field

Professional certification such as CISSP/CISM/CISA/CRISC

Tools

Cursor

Claude Code

Copilot

Job description

Affirm is seeking a Security Risk Management professional to evaluate third-party risk and governance challenges across the program, applying policy to vendor decisions and shipping automation using Python and agentic coding platforms.

The role partners with Procurement, Legal, Engineering, IT, Compliance and Privacy to drive risk reviews, dashboards, and actionable insights while maturing Affirm's security governance from a compliance focus to a security engineering discipline.