Security Risk Management Specialist II

Affirm is a remote-first fintech company that provides transparent, no-hidden-fee payment solutions. The Security Risk Management team is evolving beyond traditional GRC into an engineering-driven program that designs, automates, and scales controls, workflows, and tooling. In this role, you will evaluate, build, and refine solutions to third-party risk and security governance challenges. You will conduct third-party security assessments, review vendor questionnaires, evaluate security controls, and document risk findings. You will build and maintain automation using Python, low-code platforms, and agentic coding tools (e.g., Cursor, Claude Code, Copilot) to reduce manual GRC workflows. You will configure integrations across ticketing, GRC, and vendor management platforms, and partner with Procurement, Legal, Engineering, IT, Compliance, and Privacy on risk reviews. You will also develop dashboards, metrics, and reporting for third-party risk posture, and contribute to process improvements and documentation. Requirements include 3+ years in Information Security, Risk Management, Compliance, or related field; working knowledge of Python; familiarity with cloud environments (AWS, GCP, or Azure); knowledge of security frameworks (NIST, ISO 27001, SOC 2, PCI DSS); strong communication skills; and a professional certification (CISSP, CISM, CISA, CRISC) or equivalent experience. A BA/BS in a relevant field is preferred. Compensation includes base pay, equity rewards, monthly stipends for health, wellness, and tech spending, and benefits including 100% subsidized medical, dental, and vision coverage for you and dependents. Visa sponsorship is not available. Affirm is remote-first; most roles can be done from almost anywhere within the country of employment, with occasional in-person work possible. All new hires attend an in-person onboarding. Benefits include flexible time off, generous holidays, and an employee stock purchase plan.