Security Risk Management Lead

Leads Affirm's Security Third Party Program within a Security Risk Management team that is turning governance, risk and compliance into an engineering discipline. The role designs and improves third-party security processes and controls, assesses vendors' controls, cloud architectures and integrations with light threat modelling, and writes automation in Python, agentic coding tools or low-code platforms to replace manual intake, evidence collection, control checks and reporting. It also connects ticketing, GRC, vendor management and identity systems, builds dashboards on risk trends, and advises procurement, legal, engineering and business teams.

Affirm wants five or more years in security or risk work, working Python and agentic coding experience, cloud security familiarity and knowledge of frameworks such as NIST CSF, ISO 27001, SOC 2 and PCI DSS. Remote in the US.