Security Risk Management Lead

About the Role

The Security Risk Management team at Affirm is evolving beyond traditional governance, risk, and compliance into an engineering-driven program that designs, automates, and scales the controls, workflows, and tooling that protect Affirm and its customers.

As the Security Risk Management Lead, you will design, develop, configure, and implement solutions across the Security Third Party Program and the broader Security Risk Management program. You will shape policy and ship automation using modern tooling (Python, Cursor, Claude, etc.) to replace manual GRC work with scalable, code-defined workflows.

Responsibilities

• Lead and mature Affirm's Security Third Party Program, including process design, implementation, and continuous improvement.
• Build and maintain automation to replace manual GRC tasks (intake, triage, evidence collection, control validation, tracking, escalations, reporting) using Python, low-code platforms, and agentic coding tools.
• Design and operate workflow orchestration and integrations across ticketing, GRC platforms, vendor management tools, identity providers, and cloud control planes.
• Partner with Procurement, Legal, Engineering, IT, Compliance, Privacy, and business stakeholders to assess and manage third-party security risk.
• Translate ambiguous business and security requirements into practical, scalable program solutions and decision frameworks.
• Identify opportunities to automate manual processes and prototype solutions.
• Drive operational excellence by establishing repeatable processes, service-level expectations, metrics, and reporting.
• Evaluate third-party security controls, cloud architectures (AWS/GCP), integration patterns, and risk posture.
• Conduct light threat models on high-risk integrations and collaborate with Security SMEs.
• Manage and prioritize a portfolio of complex security risk reviews and initiatives.
• Develop dashboards, reporting mechanisms, and insights using SQL, BI tools, or custom tooling.
• Act as a trusted advisor and SME on third-party security risk management.

Qualifications

• 5+ years of experience in Information Security, Risk Management, Engineering, or relevant roles.
• Hands-on experience using agentic coding tools (Cursor, Claude Code, Copilot, etc.) and working knowledge of Python to read, modify, run scripts, and ship tools end-to-end.
• Familiarity with cloud environments (AWS, GCP, or Azure) — IAM, logging, common services, and cloud third-party security risks/controls.
• Experience with industry information security & control frameworks (NIST CSF, ISO 2700x, SOC 1 & 2, PCI DSS, NIST SP 800-53, FFIEC CAT, CIS/SANS Top 20).
• BA or BS degree in Information Security, Cyber Security, Computer Science, or related field, or commensurate experience.
• Attention to detail and familiarity with security practices and tooling.
• Demonstrated ability to drive projects toward completion and communicate technical issues to non-technical teams.
• Professional certifications in Information Security or Risk Management (CISSP, CISM, CISA, CRISC, etc.) are a plus.