Senior Third-Party Security Risk Engineer (Automation)

Affirm; Denver (CO); On-site; USD 115,000 - 165,000; Full time

Benefits offered by this job

Health coverage

FSA Wallets

Paid time off

ESPP

Job summary

Affirm is seeking a Security Risk Management professional to evaluate third-party risk and drive automated GRC workflows using Python and agentic coding tools. You will partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy to inform risk decisions and scale governance across the program.

Join a remote-first team shaping the Security Risk Management function from compliance to security engineering, building dashboards and metrics to provide clear risk visibility for

Qualifications

• 3+ years of information security, risk management, or related field.
• Working knowledge of Python for scripting or automation.
• Familiarity with AWS, GCP, or Azure cloud security concepts.
• Knowledge of NIST, ISO 27001, SOC 2, PCI DSS security frameworks.
• CISSP/CISM/CISA/CRISC or equivalent experience; BA/BS preferred.

Responsibilities

• Conduct third-party security assessments and document risk findings.
• Build and maintain automation to reduce manual GRC workloads.
• Configure integrations across ticketing, GRC, and vendor platforms.
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy.
• Develop dashboards and metrics for clear risk visibility.
• Contribute to process improvements and governance documentation.

Skills

Python

Security risk mgmt

Cloud security

Automation

Education

BA/BS in a relevant field

Tools

Cursor

Claude Code

Copilot

Job description

Affirm is seeking a Security Risk Management professional to evaluate third-party risk and drive automated GRC workflows using Python and agentic coding tools. You will partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy to inform risk decisions and scale governance across the program.

Join a remote-first team shaping the Security Risk Management function from compliance to security engineering, building dashboards and metrics to provide clear risk visibility for