Security Risk Management Specialist II

Affirm is seeking a Security Risk Management Specialist II to join its remote US-based Security Risk Management team. This role focuses on third-party risk management and security governance, combining hands-on policy application with automation and engineering practices to scale compliance workflows and protect Affirm and its customers.

Responsibilities

• Conduct third-party security assessments, including vendor questionnaire review, security control evaluation, and risk documentation for the TPRM program
• Build and maintain automation to reduce manual GRC workflows using Python, low-code platforms, and agentic coding tools
• Configure and maintain integrations across ticketing, GRC, and vendor management platforms to enable consistent workflow execution
• Partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy teams on third-party risk reviews, follow-up actions, and risk-informed decisions
• Develop and maintain dashboards, metrics, and reporting to provide stakeholder visibility into third-party risk posture
• Contribute to process improvements and program documentation to mature security governance practices

Requirements

• 3+ years of hands-on experience in Information Security, Risk Management, Compliance, or related field
• Working knowledge of Python for scripting or automation
• Proficiency with agentic coding tools such as Cursor, Claude Code, or Copilot
• Familiarity with GRC platforms, ticketing systems, and vendor management tools
• Experience conducting vendor security assessments and evaluating third-party risk