Security Risk Engineer II — TPRM & Automation

Affirm; Washington (District of Columbia); On-site; USD 115,000 - 180,000; Full time

Benefits offered by this job

Health care coverage

Employee stock purchase plan (ESPP)

Remote-first company

Job summary

Affirm is seeking a Security Risk Management Engineer to evaluate and refine third-party risk solutions across the Security Third Party Program. You will ship automation using Python and agentic coding tools to replace manual GRC work with scalable, code-defined workflows, while partnering with business and engineering stakeholders to mature security governance.

You will drive third-party risk assessments, build dashboards, and help translate security risk concepts to diverse audiences as Affirm

Qualifications

• 3+ years in information security, risk, or compliance.
• Familiar with agentic coding tools and Python scripting.
• Cloud environments (AWS, GCP, or Azure) familiarity.
• Knowledge of security frameworks (NIST, ISO 27001, SOC 2, PCI DSS).
• Strong written and verbal communication; translating risk concepts.
• Professional certifications or equivalent experience (CISSP/CISM/CISA/CRISC).

Responsibilities

• Conduct third-party security assessments and document risk findings.
• Build automation to reduce manual GRC workflows using Python and low-code tools.
• Configure and maintain integrations across ticketing, GRC, and vendor management.
• Collaborate with Procurement, Legal, Engineering, IT, Compliance, and Privacy on reviews.
• Develop dashboards and reporting to visualize third-party risk posture.
• Contribute to process improvements and program documentation.

Skills

Python scripting

Agentic coding tools

Cloud security

Security frameworks

Technical communication

Risk assessment

Education

CISSP/CISM/CISA/CRISC

BA/BS in relevant field

Tools

Cursor

Claude Code

Copilot

GRC tools

Job description

Affirm is seeking a Security Risk Management Engineer to evaluate and refine third-party risk solutions across the Security Third Party Program. You will ship automation using Python and agentic coding tools to replace manual GRC work with scalable, code-defined workflows, while partnering with business and engineering stakeholders to mature security governance.

You will drive third-party risk assessments, build dashboards, and help translate security risk concepts to diverse audiences as Affirm