Senior CIAM Security Engineer (Backend Identity)

Affirm; Kitchener; On-site; CAD 181,000 - 241,000; Full time

Benefits offered by this job

Health coverage for you and dependents

Monthly health, wellness and tech stip

Equity (ESPP)

Flexible Spending Wallets

Time off

Job summary

Affirm is building the next generation of customer identity and authentication. This role is a hands-on engineering position inside Information Security, focused on designing and shipping core CIAM capabilities that protect customers and support growth.

You will build and operate backend services that power registration, login, authorization, and account lifecycle flows across B2C and B2B experiences. You will work closely with partner engineering teams and ensure identity features are delivered

Qualifications

• Deep hands-on experience building CIAM systems with OAuth 2.0, OIDC, SAML, and SCIM.
• 5+ years of backend software engineering experience.
• Strong Python or Kotlin experience and API design skills.
• Experience with CI/CD pipelines and cloud-native development (AWS).
• Security-focused mindset with emphasis on authentication and identity services.

Responsibilities

• Design, build, and operate CIAM backend services for registration, login, authorization, and profile management.
• Implement identity standards with scalable, clean integration patterns.
• Develop backend APIs for web, mobile, and partner apps.
• Automate CIAM infrastructure and deployments using IaC and pipelines.
• Monitor and optimize CIAM services for performance and security.

Skills

CIAM design

OAuth 2.0

OIDC

SAML

SCIM

Python/Kotlin

AWS

Kubernetes

API design

CI/CD

Infra as Code

Security fundamentals

Tools

Cursor

Terraform

GitHub

Buildkite

AWS tooling

Job description

Affirm is building the next generation of customer identity and authentication. This role is a hands-on engineering position inside Information Security, focused on designing and shipping core CIAM capabilities that protect customers and support growth.

You will build and operate backend services that power registration, login, authorization, and account lifecycle flows across B2C and B2B experiences. You will work closely with partner engineering teams and ensure identity features are delivered