Remote CIAM Security Engineer – Senior Backend Identity

Affirm; Nashville (TN); On-site; USD 204,000 - 264,000; Full time

Benefits offered by this job

Health coverage

FSA Wallets

Time off

ESPP

Job summary

Affirm is seeking an experienced backend engineer to design and ship core CIAM capabilities for registration, login, authorization, and account lifecycle across B2C and B2B experiences. You will implement identity standards such as OAuth 2.0, OIDC, SAML, and SCIM in code, building scalable services in Python and Kotlin.

The role emphasizes security, reliability, and strong collaboration with global teams. You’ll own secure authentication flows end-to-end, including MFA and adaptive controls, and

Qualifications

• Deep hands-on CIAM design with OAuth 2.0, OIDC, SAML, SCIM

Responsibilities

• Design, build, and operate CIAM backend services for registration, authentication, authorization, and profile management.
• Implement and extend identity standards in code with scalable, secure patterns.
• Develop Python/Kotlin APIs exposing identity capabilities to web, mobile, and partner apps.
• Integrate CIAM platforms with internal data stores, messaging, fraud signals, and downstream systems.
• Own end-to-end secure authentication flows including MFA and adaptive authentication.
• Automate CIAM infra and deployments via Infrastructure as Code and CI/CD pipelines.
• Monitor, debug, and optimize CIAM services for performance and abuse detection.

Skills

OAuth 2.0

OIDC

SAML

SCIM

Python

Kotlin

AWS

MySQL

Spark

Kubernetes

CI/CD

GitHub

Buildkite

Terraform

IaC

CIAM integrations

Security fundamentals

Tools

Buildkite

Terraform

Job description

Affirm is seeking an experienced backend engineer to design and ship core CIAM capabilities for registration, login, authorization, and account lifecycle across B2C and B2B experiences. You will implement identity standards such as OAuth 2.0, OIDC, SAML, and SCIM in code, building scalable services in Python and Kotlin.

The role emphasizes security, reliability, and strong collaboration with global teams. You’ll own secure authentication flows end-to-end, including MFA and adaptive controls, and