Security Risk Engineer, Third-Party & Automation

Affirm; Richmond (VA); On-site; USD 115,000 - 180,000; Full time

Benefits offered by this job

Health care coverage

ESPP

Flexible Spending Wallets

Time off

Job summary

Affirm is a remote‑first company redefining credit with security at the core. We seek a Security Risk Management Specialist to drive third‑party risk programs, automate GRC workflows, and partner with Procurement, Legal, and Engineering to scale risk governance.

You’ll use Python, Cursor and other tools to replace manual work with scalable, code‑defined processes, while maturing the security program across the company.

Qualifications

• 3+ years in information security, risk management, or a related field.
• Familiar with agentic coding tools and Python scripting.
• Knowledge of cloud security concepts and common frameworks (NIST, ISO 27001, SOC 2, PCI DSS).

Responsibilities

• Conduct third‑party security assessments using vendor questionnaires.
• Develop and maintain automation to reduce manual GRC work.
• Configure integrations across ticketing, GRC, and vendor management platforms.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews.
• Develop dashboards and metrics to visualize third‑party risk posture.
• Document processes to mature the security governance program.

Skills

Python

Automation

Security Risk

Education

BA/BS in relevant field

Security certifications (CISSP/CISM/CISA/CRISC)

Tools

Cursor

Claude Code

Copilot

Job description

Affirm is a remote‑first company redefining credit with security at the core. We seek a Security Risk Management Specialist to drive third‑party risk programs, automate GRC workflows, and partner with Procurement, Legal, and Engineering to scale risk governance.

You’ll use Python, Cursor and other tools to replace manual work with scalable, code‑defined processes, while maturing the security program across the company.