TPRM Security Risk Engineer (Automation)

Affirm; Palo Alto (CA); On-site; USD 130,000 - 180,000; Full time

Benefits offered by this job

Health coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is seeking a Security Risk Management Engineer to advance third-party risk and governance across the Security Third Party Program. You will apply security policy to vendor decisions and ship automation using Python, Cursor, Claude, and other agentic tools to scale GRC work.

You will partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews and follow-up actions while developing dashboards and reporting that expose risk posture to stakeholders.

Qualifications

• 3+ years in Information Security, Risk Management, Compliance or related field
• Familiar with agentic coding tools (Cursor, Claude Code, Copilot) and Python scripting
• Knowledge of cloud environments (AWS, GCP, Azure) and security frameworks (NIST, ISO 27001, SOC 2, PCI DSS)

Responsibilities

• Conduct third-party security assessments and document risk findings for the TPRM program
• Build and maintain automation to reduce manual GRC workflows using Python and low-code tools
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews and actions
• Develop dashboards and metrics to provide visibility into third-party risk posture
• Contribute to process improvements and program documentation for security governance

Skills

Information Security

Risk Management

Compliance

Python scripting

Agentic tools

Education

BA/BS in related field

Certifications (CISSP/CISM/CISA/CRISC)

Tools

Cursor

Claude Code

Copilot

Cloud security concepts

Job description

Affirm is seeking a Security Risk Management Engineer to advance third-party risk and governance across the Security Third Party Program. You will apply security policy to vendor decisions and ship automation using Python, Cursor, Claude, and other agentic tools to scale GRC work.

You will partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews and follow-up actions while developing dashboards and reporting that expose risk posture to stakeholders.