Security Risk Management Engineer II (TPRM & Automation)

Affirm; San Jose (CA); On-site; USD 130,000 - 180,000; Full time

Benefits offered by this job

Health coverage

Equity or stock plan

Remote-first company culture

Stipends for health, wellness, andtech

Job summary

Affirm is seeking a Security Risk Management professional to evaluate and automate third-party risk governance. You will build scalable, code-defined workflows using Python and agentic tools, while partnering with Procurement, Legal, Engineering, IT, and Privacy to drive risk-informed decisions.

The role emphasizes maturing security governance into an engineering discipline and delivering dashboards and metrics for stakeholders across the organization.

Qualifications

• 3+ years of experience in Information Security, Risk Management, Compliance, or a related field.
• Familiar with agentic coding tools (Cursor, Claude Code, Copilot) and Python for scripting/automation.
• Familiarity with cloud environments (AWS, GCP, Azure) and cloud security concepts.
• Knowledge of security frameworks such as NIST, ISO 27001, SOC 2, and PCI DSS.
• Clear written and verbal communication; ability to translate security risk concepts for technical and non-technical audiences.
• Professional certification such as CISSP, CISM, CISA, or CRISC or equivalent experience; BA/BS preferred.

Responsibilities

• Conduct third-party security assessments, review vendor questionnaires, evaluate controls, and document risk findings for Affirm's TPRM program.
• Build and maintain automation to reduce manual GRC workflows using Python, low-code platforms, and agentic coding tools.
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms for repeatable workflows.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on third-party risk reviews and actions.
• Develop and maintain dashboards, metrics, and reporting to provide visibility into third-party risk posture.
• Contribute to process improvements and program documentation to mature Affirm's security governance.

Skills

Information Security

Risk Management

Communication

Education

Bachelor's degree in a related field

Tools

Python

Cursor

Claude Code

Copilot

Job description

Affirm is seeking a Security Risk Management professional to evaluate and automate third-party risk governance. You will build scalable, code-defined workflows using Python and agentic tools, while partnering with Procurement, Legal, Engineering, IT, and Privacy to drive risk-informed decisions.

The role emphasizes maturing security governance into an engineering discipline and delivering dashboards and metrics for stakeholders across the organization.