Security Risk Management Lead
Core
Lead and mature Affirm's Security Third Party Program, focusing on pre-launch due diligence for international market entry, M&A security assessments, and post-close integration of acquired vendor portfolios.
Role type
Senior Security Risk Management Lead (Engineering-driven GRC)
Builds
Scalable, code-defined workflows and automation for third-party risk management using Python and agentic coding tools.
Domain
Financial Technology (FinTech) / Third-Party Risk Management / Cybersecurity Governance
Required skills
Security due diligence, M&A security assessment, Third-party risk management, Python scripting, Cloud security (AWS/GCP/Azure), GRC frameworks (NIST, ISO, SOC, PCI DSS), Workflow orchestration, Threat modeling, Data residency compliance
Preferred skills
Agentic coding tools (Cursor, Claude), International data protection regulations (GDPR, DORA), Professional certifications (CISSP, CISM, CISA, CRISC)
Technologies
Python, AWS, GCP, Azure, SQL, BI tools, GRC platforms, Ticketing systems, Identity providers
Responsibilities
Design and implement processes for pre-launch security due diligence for third parties in new markets; Support M&A security due diligence and turn findings into risk ratings; Lead post-close integration of acquired company vendor portfolios; Design and operate workflow orchestration across systems; Evaluate third party security controls and cloud architectures; Conduct threat modeling assessments; Develop dashboards and reporting mechanisms for risk visibility.
Seniority
Senior, hands-on IC
