Senior Third-Party Security Automation Engineer

Affirm; Philadelphia (Philadelphia County); On-site; USD 115,000 - 180,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

Employee stock purchase plan (ESPP)

Job summary

Affirm is shaping a security engineering program to address third-party risk and governance across the Security Risk Management team. You will apply security policy to vendor decisions and ship automation with Python, Cursor, Claude, and other agentic tools to replace manual GRC work with scalable workflows.

You will collaborate with Procurement, Legal, Engineering, IT, Compliance, and Privacy to perform risk reviews, build dashboards, and drive risk-informed actions.

Qualifications

• 3+ years of experience in Information Security, Risk Management, Compliance, or a related field.
• Familiarity with agentic coding tools and Python for scripting/automation.
• Knowledge of cloud environments (AWS, GCP, Azure) and common cloud security concepts.

Responsibilities

• Conduct third-party security assessments and document risk findings for Affirm's TPRM program.
• Build and maintain automation to reduce manual GRC workflows using Python and low-code tooling.
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms to ensure repeatable workflows.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on third-party risk reviews and actions.
• Develop dashboards and reporting to provide visibility into third-party risk posture.
• Contribute to process improvements and documentation to mature Affirm's security governance.

Skills

Security risk management

Communication

Education

BA/BS in a relevant field

CISSP / CISM / CISA / CRISC (or equivalent)

Tools

Python

Cursor

Claude Code

Copilot

Job description

Affirm is shaping a security engineering program to address third-party risk and governance across the Security Risk Management team. You will apply security policy to vendor decisions and ship automation with Python, Cursor, Claude, and other agentic tools to replace manual GRC work with scalable workflows.

You will collaborate with Procurement, Legal, Engineering, IT, Compliance, and Privacy to perform risk reviews, build dashboards, and drive risk-informed actions.