Remote Senior Insider Threat Security Engineer

Affirm, Inc.; San Francisco, Los Angeles (CA, CA); Remote; CAD 153,000 - 213,000; Full time

Benefits offered by this job

Health coverage for you and dependents

Monthly tech stipends

Flexible time off and holidays

Equity rewards via ESPP

Job summary

Affirm, Inc. is seeking an expert to mature its insider threat program.

You will build controls, detection use cases, and investigative practices, supporting insider risk investigations and coordinating with Legal, HR, Privacy, and Compliance to maintain a trusted program. You will model data, develop playbooks, and turn results into production detections, while automating evidence collection and reporting using Python and automation platforms.

Qualifications

• Deep expertise in security engineering, security operations, insider risk, or digital forensics.
• Track record of standing up new security capabilities where little existed before.
• Experience running investigations end to end, including evidence handling, log and endpoint forensics, timeline reconstruction, and written findings suitable for Legal and HR audiences.
• Ability to write and evaluate detection logic against endpoint, identity, cloud, and SaaS telemetry in a SIEM (Splunk, Elastic, Panther, Chronicle, or similar)
• Hands-on experience with insider risk tooling such as DLP, UEBA, endpoint detection and response, CASB, and access governance, with a practical sense of their strengths and limits
• Working knowledge of Python for security tooling and automation
• Experience building and maintaining production workflows in automation platforms such as Tines, Torq, or similar
• Experience building and running agentic automations in production that assist with alert triage and investigation, such as LLM-driven enrichment, summarization, or first-pass analysis, with a clear view of where human review stays in the loop
• Discretion and sound judgment handling sensitive investigations, and comfort navigating the privacy, legal, and employee-relations considerations that insider work carries
• Clear written and verbal communication skills, with the ability to work across Security, Engineering, Legal, HR, Privacy, and Compliance
• Experience in regulated or financial services environments (SOC 2, PCI DSS, GLBA) is a plus

Responsibilities

• Lead the build-out of insider threat workstreams from design to day-to-day operation.
• Develop the program's operating mechanics, including investigative standards, playbooks, and metrics.
• Support insider risk investigations with telemetry analysis and written findings for Legal/HR.
• Collaborate with Legal, HR/Employee Relations, Privacy, and Compliance on case handling and escalation.
• Model high-risk data and systems for insider risk; collaborate with detection engineers for production detections.
• Automate the program's load with workflow platforms and Python for evidence collection, routing, and reporting.
• Create agentic automations to aid triage and investigation while defining human decision points.

Skills

Security engineering

Security operations

Insider risk

Digital forensics

Investigation

Evidence handling

Endpoint forensics

Detection logic

Python

Automation tooling

Tools

Splunk

Elastic

Panther

Chronicle

SIEM

DLP

UEBA

EDR

CASB

Access governance

Tines

Torq

Job description

Affirm, Inc. is seeking an expert to mature its insider threat program.

You will build controls, detection use cases, and investigative practices, supporting insider risk investigations and coordinating with Legal, HR, Privacy, and Compliance to maintain a trusted program. You will model data, develop playbooks, and turn results into production detections, while automating evidence collection and reporting using Python and automation platforms.