Security Risk Management Lead

Affirm

. Lead and mature Affirm's Security Third Party Program, including processes, controls, and operational workflows .

Posted 10/26/2026full-timeRemote • CanadaSenior💰 CA$128,000 - CA$188,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading third party security risk management programs, including due diligence for M&A and international market entry. Proficient in automating processes and integrating security frameworks with cloud architectures while ensuring compliance with regulatory requirements.

Highest-signal resume keywords

Third Party Risk ManagementSecurity Due DiligencePython ProgrammingCloud Security (AWS/GCP/Azure)Information Security Frameworks (NIST, ISO, PCI DSS)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security Risk AssessmentsAutomation ToolsSQLBI ToolsThreat ModelingIncident ManagementData Residency ComplianceIntegration PatternsVendor ManagementSecurity Controls Evaluation

Soft Skills

Project ManagementCommunication SkillsJudgment and DiscretionCollaborationProblem-Solving

Tools & Technologies

CursorClaude CodeCopilotGRC SystemsTicketing SystemsCloud Systems

Certifications & Qualifications

CISSPCISMCISACRISC

Industry Keywords

Information SecurityRisk ManagementM&A SecurityData ProtectionOperational Resilience

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityGoogle Cloud PlatformPythonSQL

About the role

Key responsibilities & impact

Lead and mature Affirm's Security Third Party Program, including processes, controls, and operational workflows
Own pre-launch security due diligence for third parties supporting entry into new international markets
Adapt third party assessment standards for data residency, cross-border data transfer, and local regulatory requirements
Support M&A security due diligence by assessing acquisition targets' security programs, controls, incident history, data handling, and third party dependencies
Lead post-close integration of acquired companies' vendor portfolios into Affirm's third party program
Design and operate workflow orchestration and integrations across ticketing, GRC, vendor management, identity, and cloud systems
Partner with Procurement, Legal, Engineering, IT, Compliance, Privacy, Corporate Development, international launch teams, and business stakeholders
Translate ambiguous business and security requirements into scalable program solutions and decision frameworks
Automate manual processes and prototype solutions using modern tooling
Establish repeatable processes, service-level expectations, metrics, and reporting
Evaluate third party security controls, AWS/GCP cloud architectures, integration patterns, and risk posture
Conduct threat modeling assessments on high-risk integrations
Manage and prioritize complex security risk reviews and initiatives, including confidential deal work
Develop dashboards, reporting mechanisms, and program insights using SQL, BI tools, or custom tooling
Act as a trusted advisor and subject matter expert on third party security risk management
Contribute to Security Risk Management strategy by scaling and strengthening security governance through engineering

Requirements

What you’ll need

5+ years of experience in Information Security, Risk Management, Engineering and/or relevant roles
Experience performing security due diligence on M&A targets, or running third party risk assessments across multiple countries or regulatory regimes
Hands-on experience using agentic coding tools such as Cursor, Claude Code, and Copilot
Working knowledge of Python sufficient to read, modify, and run scripts, build automations, and ship small tools end-to-end
Familiarity with AWS, GCP, or Azure, including IAM, logging, common services, and cloud security risks and controls
Experience engineering solutions via Python, Claude, Cursor, or other agentic coding tooling
Experience with information security and control frameworks including NIST Cybersecurity Framework, ISO 2700x, SOC 1 & 2 (SSAE 18), ISAE 3402, PCI DSS, NIST 800-53, and CIS Critical Security Controls
BA or BS degree in Information Security, Cyber Security, Computer Science, or related field, or commensurate experience
Experience with security practices and security tooling
Demonstrated ability to drive projects toward completion
Ability to communicate technical issues to non-technical teams and leadership
Sound judgment and discretion handling confidential, deal-sensitive information
Familiarity with international data protection and third party or operational resilience requirements is a plus
Professional certification in Information Security or Risk Management, such as CISSP, CISM, CISA, or CRISC, is a plus
Excellent written and verbal communication skills

Benefits

Comp & perks

100% subsidized medical coverage for employees and dependents
Dental and vision coverage for employees and dependents
Monthly tech setup spending stipend
Monthly health and wellness spending stipends
Flexible time off
Generous holiday calendars
Employee stock purchase plan (ESPP) allowing employees to buy Affirm stock at a discount
Remote-first work flexibility
In-person onboarding experience for all new hires
Inclusive interview process and accommodations for candidates with disabilities