Security Risk Engineer, Third-Party & Automation

Affirm, Inc.; Northern (KY); Hybrid; USD 115,000 - 165,000; Full time

Benefits offered by this job

Health coverage including dependents

Flexible Spending Wallets for health,

Time off and holidays

Employee stock purchase program (ESPP)

Job summary

Affirm, Inc. is seeking a Security Risk Management Specialist to scale the Third Party Risk Management program. You will assess vendors, automate GRC workflows with Python and agentic tools, and partner across Procurement, Legal, Engineering, and Privacy to drive risk-informed decisions.

You will build dashboards, refine security controls, and help mature Affirm's security governance into a security engineering discipline while working in a remote-first environment across the US.

Qualifications

• 3+ years of experience in information security, risk management or a related field.
• Experience applying security policy to vendor decisions and automating GRC work.
• Familiarity with cloud environments (AWS, GCP, Azure) and common security standards.

Responsibilities

• Conduct third-party security assessments and document risk findings.
• Develop and maintain automation to reduce manual GRC workflows.
• Configure integrations across ticketing, GRC, and vendor management platforms.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on reviews.
• Develop dashboards and reports to show third-party risk posture.
• Contribute to process improvements and governance documentation.

Skills

Security risk management

Python scripting

Cloud security

Communication

Education

BA/BS in a relevant field

CISSP / CISM / CISA / CRISC candidate

Tools

Cursor

Claude Code

Copilot

Job description

Affirm, Inc. is seeking a Security Risk Management Specialist to scale the Third Party Risk Management program. You will assess vendors, automate GRC workflows with Python and agentic tools, and partner across Procurement, Legal, Engineering, and Privacy to drive risk-informed decisions.

You will build dashboards, refine security controls, and help mature Affirm's security governance into a security engineering discipline while working in a remote-first environment across the US.