Remote-First Senior Product Security Engineer

Affirm, Inc.; Los Angeles (CA); Remote; USD 195,000 - 255,000; Full time

Benefits offered by this job

Health coverage for dependents

Tech stipends

Flexible time off

Employee stock purchase plan (ESPP)

Job summary

Affirm, Inc. is seeking a Senior Product Security Engineer who will collaborate with product and engineering teams to secure our cloud-based services. This role emphasizes threat modeling, secure coding reviews, and security-automation initiatives to strengthen product defenses.

The ideal candidate will understand web app architecture, authentication standards like SAML/OAuth2, and CI/CD pipelines. We offer a remote-first environment with a competitive base pay and comprehensive benefits.

Qualifications

• BS degree in a related field or equivalent experience; MS degree is a plus.
• Experience securing web applications and reviewing source code.
• Familiar with threat modeling and secure development lifecycle.
• Experience with PCI or other regulated environments.
• Knowledge of authentication standards (SAML, OAuth2) and CI/CD practices.

Responsibilities

• Partner with product teams to embed security in the product lifecycle.
• Conduct threat modeling and architecture reviews to identify threats and mitigations.
• Review product source code to identify vulnerabilities and recommend secure implementations.
• Seek opportunities to automate security processes where appropriate.
• Identify emerging vulnerabilities and develop proactive solutions.
• Advise product teams on security requirements early in development lifecycle.
• Decompose large cross-team projects into tasks and drive them to closure.

Skills

Web app security

Threat modeling

Code review

Automation

Security requirements

Cloud (AWS/Azure)

CI/CD knowledge

Education

BS degree in related field

MS degree in related field

Tools

Python

Kotlin

Java

AWS

Azure

Job description

Affirm, Inc. is seeking a Senior Product Security Engineer who will collaborate with product and engineering teams to secure our cloud-based services. This role emphasizes threat modeling, secure coding reviews, and security-automation initiatives to strengthen product defenses.

The ideal candidate will understand web app architecture, authentication standards like SAML/OAuth2, and CI/CD pipelines. We offer a remote-first environment with a competitive base pay and comprehensive benefits.