Drimva

Affirm

Security Risk Management Lead

$146K–$225K

Remote US · Remote · Full-time · Posted Jun 5, 2026

Experience
5+ years in Information Security, Risk Management, Engineering and/or relevant roles.
Education
BA or BS degree in Information Security, Cyber Security, Computer Science or related field or commensurate experience.
Visa sponsorship
Visa sponsorship is not available for this position.

About the job

Leads Affirm’s third-party security risk program and engineers automation, workflows, and reporting to scale security risk management.

What you'll do

  • Lead and improve the Security Third Party Program, including processes, controls, workflows, metrics, and reporting.
  • Build automation and integrations for GRC tasks and risk workflows using Python, low-code platforms, and agentic coding tools.
  • Assess third-party security risks, cloud architectures, controls, and high-risk integrations; advise stakeholders and leadership.

What they ask for

  • 5+ years of experience in Information Security, Risk Management, Engineering and/or relevant roles.
  • Hands-on experience with agentic coding tools and working knowledge of Python sufficient to build automations and small tools.
  • Familiarity with cloud environments (AWS, GCP, or Azure), including IAM, logging, services, and applicable security risks and controls.
  • BA or BS degree in Information Security, Cyber Security, Computer Science or related field or commensurate experience.

Nice to have

  • Professional certification in Information Security or Risk Management, such as CISSP, CISM, CISA, or CRISC.

Pay

USA Pacific base pay range (CA, WA, NY, NJ, CT) per year: $165,000 - $225,000 USD (base salary); USA Sapphire base pay range (all other U.S. states) per year: $146,000 - $206,000 USD (base salary)

Tools

Python, Cursor, Claude, Claude Code, Copilot, AWS, GCP, Azure

AI focus

Uses agentic coding tools, including Cursor and Claude, to build automation and replace manual GRC work with scalable workflows.

Model-written summary · the original posting is authoritative

First seen Oct 10, 2026 · Last verified Nov 5, 2026 (UTC)