Security Risk Management Lead

Affirm

Confirmed live today High trust
Remote

Quick summary

Work type
Remote
Location
Remote
Salary
$165,000–$225,000 / yr
Posted
144 days ago
Freshness
Confirmed live today

Market check

Salary context

Competitive pay

How this pay compares to similar roles

Similar $187k
This role $195k
$125k $240k
below market most similar roles pay here above market

This role pays more than 61% of similar roles. Most pay $162,000–$212,400 — the blue band above. At the midpoint, this role pays about $195k versus about $187k for comparable roles.

Based on 240 similar postings.

Employer

About Affirm

Affirm is a buy-now, pay-later (BNPL) financial technology company that offers point-of-sale installment loans to consumers, allowing them to split purchases into fixed monthly payments with transparent terms. Industry: Financial Technology & Consumer Lending

Affirm currently has 64 open roles on FindRole.

Listed pay typically runs $195,000–$255,000 across 60 roles with salary data.

Most-posted roles

View all roles at Affirm

At a glance

TL;DR · Security Risk Management Lead

The Security Risk Management Lead joins the Security Risk Management team to transform security governance into an engineering-driven discipline. This role focuses on designing, developing, and implementing automated solutions to manage the Security Third Party Program and broader risk workflows. You will build automation to replace manual tasks like intake, triage, and evidence collection using Python, low-code platforms, and agentic coding tools such as Cursor and Claude. Key responsibilities include orchestrating integrations across ticketing systems, identity providers, and cloud control planes in AWS or GCP. You will evaluate third-party security controls, conduct light threat models, and develop dashboards using SQL and BI tools. The role requires expertise in frameworks like NIST, ISO 2700x, and PCI DSS to manage complex security risk reviews and provide actionable risk-based recommendations.

What you'll do

  • Lead and mature the Security Third Party Program by designing and implementing processes, controls, and operational workflows.
  • Build and maintain automation using Python and agentic coding tools to replace manual GRC tasks like intake and evidence collection.
  • Design and operate workflow orchestrations across ticketing systems, GRC platforms, and cloud control planes.
  • Assess and manage security risks across third-party relationships in partnership with Legal, Engineering, and Procurement.
  • Evaluate third-party security controls and cloud architectures to provide risk posture recommendations to leadership.
  • Conduct light threat models on high-risk integrations and partner with Security SMEs for deeper diligence.
  • Develop dashboards and reporting mechanisms using SQL or BI tools to improve visibility into risk trends and bottlenecks.
  • Translate ambiguous business requirements into scalable program solutions and decision frameworks.

What we're looking for

  • 5+ years of experience in Information Security, Risk Management, Engineering, and/or relevant roles.
  • Hands-on experience using agentic coding tools (Cursor, Claude Code, Copilot, etc.) and a working knowledge of Python.
  • Experience engineering solutions via Python, Claude, Cursor, or other agentic coding tooling.
  • Familiarity with cloud environments (AWS, GCP, or Azure) including IAM, logging, and security controls.
  • Experience with industry-based information security and control frameworks such as NIST, ISO 2700x, SOC1&2, PCI DSS, or NIST-800-53.
  • BA or BS degree in Information Security, Cyber Security, Computer Science, or a related field or commensurate experience.
  • Excellent written and verbal communication skills with the ability to explain technical issues to non-technical teams.
  • Professional certification in Information Security or Risk Management (such as CISSP, CISM, CISA, CRISC, etc.) (preferred).

More like this

Similar roles

Vulnerability Management Lead

Booz Allen Hamilton

Reston, VA +3 4 days ago $99,000–$225,000
ACAS Tenable.sc Nessus STIG RMF NIST 800-53 SCAP OpenSCAP Infrastructure as Code Python PowerShell SQL AWS GovCloud Azure Government ServiceNow Xacta eMASS Tableau Power BI Ansible
5+ yrs exp

Cloud Security Architecture Lead

Nvidia

Remote (CA) +2 6 days ago $272,000–$431,250
AWS Azure GCP Cloud Kubernetes Zero Trust Confidential Computing SDN Cryptography Post-Quantum Cryptography Network Segmentation AI/ML Infrastructure GPU Compute Clusters
10+ yrs exp Remote

Technical Lead, Security Platforms

State Street

Quincy, MA 26 days ago $120,000–$202,500
Endpoint Security Cloud Security Security Automation Infrastructure-as-Code configuration-management Incident Response Threat Intelligence Threat Hunting Vulnerability Management Cloud-native APIs Event-driven Workflows AI-enabled Security

Senior Lead Cloud Security Engineering

Northern Trust

Chicago, IL 35 days ago $114,500–$194,700
Azure AWS Terraform Python CSPM Wiz Microsoft Defender for Cloud CI/CD GitHub Actions Git Azure Entra Okta Ping NIST 800-53 CIS Policy as Code Infrastructure as Code
8+ yrs exp Hybrid

Enterprise Security Architect, Lead

Booz Allen Hamilton

McLean, VA +1 105 days ago
Zero Trust AWS Azure Google Cloud Kubernetes DevSecOps SIEM SOAR SASE DLP Palo Alto F5 NIST SP 800‑53 RMF FedRAMP ISO 27001 COBIT Agile Encryption Tokenization
7+ yrs exp

Enterprise Security Architect, Lead

Booz Allen Hamilton

Raleigh, NC 10 days ago
Security Architecture AWS Azure GCP Zero Trust NIST CSF NIST SP 800-53 CIS Critical Security Controls SIEM EDR XDR IDS/IPS WAF WAAP SD-WAN SASE SSE CASB SWG ZTNA PKI CAOps Splunk DNS Protection Load Balancers IP Routing Data Center Design threat-modeling Security Automation
10+ yrs exp