Senior Security Risk Engineer: Third-Party & Automation

Affirm; Raleigh (NC); On-site; USD 115,000 - 180,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

Job summary

Affirm is seeking a Security Risk Management professional to evaluate, build, and refine solutions to third-party risk and governance challenges within the Security Third Party Program. You will ship automation using Python and agentic coding platforms to replace manual GRC work with scalable, code-defined workflows.

As part of the transformation of Affirm's Security Risk Management from compliance to security engineering, you will partner with Procurement, Legal, Engineering, and Privacy to

Qualifications

• 3+ years in Information Security or related fields.
• Familiar with agentic coding tools and Python scripting.
• Experience with cloud environments (AWS, GCP, or Azure).
• Knowledge of NIST, ISO 27001, SOC 2, and PCI DSS.
• Strong written and verbal communication; translate risk concepts.

Responsibilities

• Conduct third-party security assessments and document risk findings for the TPRM program.
• Build and maintain automation to reduce manual GRC workflows using Python and low-code tools.
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews and actions.
• Develop dashboards, metrics, and reporting to show third-party risk posture to stakeholders.
• Contribute to process improvements and program documentation.

Skills

Python

Agentic coding tools

Security risk management

Clear communication

Education

BA/BS in a relevant field

CISSP/CISM/CISA/CRISC or equivalent

Tools

Cursor

Claude Code

Copilot

Job description

Affirm is seeking a Security Risk Management professional to evaluate, build, and refine solutions to third-party risk and governance challenges within the Security Third Party Program. You will ship automation using Python and agentic coding platforms to replace manual GRC work with scalable, code-defined workflows.

As part of the transformation of Affirm's Security Risk Management from compliance to security engineering, you will partner with Procurement, Legal, Engineering, and Privacy to