Security Risk Engineer — Third-Party & Automation

Affirm; San Diego (CA); On-site; USD 130,000 - 180,000; Full time

Benefits offered by this job

Health coverage for dependents

Stock purchase program

Generous stipends for technology

Flexible spending accounts

Job summary

Affirm is a remote‑first company focused on secure, compliant risk management for third‑party relationships. You will evaluate and improve governance across the Security Third Party Program using coding tools and automation to replace manual work with scalable, code‑defined workflows.

The role requires collaboration with Procurement, Legal, Engineering, IT, Compliance, and Privacy while building dashboards to show risk posture and driving program maturity over time.

Qualifications

• 3+ years of experience in Information Security, Risk Management, Compliance, or related field.
• Experience with agentic coding tools and Python scripting for automation.
• Familiarity with cloud security concepts and common frameworks (NIST, ISO 27001, SOC 2, PCI DSS).
• Ability to translate risk concepts for technical and non-technical audiences.
• Professional certification pursuit (CISSP/CISM/CISA/CRISC) or equivalent experience preferred.

Responsibilities

• Conduct third-party security assessments and document risk findings for the TPRM program.
• Build automation to reduce manual GRC workflows using Python and low-code tools.
• Configure and maintain integrations across ticketing, GRC, and vendor systems.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews.
• Develop dashboards and metrics to communicate third-party risk posture.
• Contribute to process improvements and program documentation.

Skills

Information security

Risk management

Compliance

Education

BA/BS preferred

Tools

Cursor

Claude Code

Copilot

Job description

Affirm is a remote‑first company focused on secure, compliant risk management for third‑party relationships. You will evaluate and improve governance across the Security Third Party Program using coding tools and automation to replace manual work with scalable, code‑defined workflows.

The role requires collaboration with Procurement, Legal, Engineering, IT, Compliance, and Privacy while building dashboards to show risk posture and driving program maturity over time.