Senior CIAM Backend Security Engineer - Remote

Affirm; Boulder (CO); On-site; USD 204,000 - 264,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is hiring a Senior Backend CIAM Engineer to design, build, and operate core identity services powering registration, login, and account lifecycle for B2C and B2B experiences. You will implement OAuth 2.0, OIDC, SAML, and SCIM in code and ensure scalable, secure patterns across highly available distributed systems on AWS.

You will develop Python and Kotlin APIs, collaborate with partner teams, and own secure authentication, MFA, device binding, and adaptive authentication.

Qualifications

• 7+ years designing, developing and shipping backend systems at scale
• Backend experience in Python or Kotlin
• Strong cloud & distributed system knowledge (AWS, MySQL, Spark, Kubernetes)
• Experience with CI/CD pipelines and IaC tooling

Responsibilities

• Design, build, and operate CIAM backend services for registration, authentication, authorization, and account lifecycle
• Implement OAuth 2.0, OIDC, SAML, and SCIM in code with scalable patterns
• Develop APIs/services in Python and Kotlin for web, mobile, and partner apps
• Integrate CIAM platforms with internal data stores, messaging, fraud signals, and downstream systems
• Own secure authentication and account flows end-to-end including MFA and adaptive auth
• Automate CIAM infrastructure and deployments using Infrastructure as Code and CI/CD pipelines

Skills

Python

Kotlin

AWS

MySQL

Spark

Kubernetes

OAuth 2.0/OIDC

CI/CD

Terraform

Tools

GitHub workflows

Buildkite

Terraform

Job description

Affirm is hiring a Senior Backend CIAM Engineer to design, build, and operate core identity services powering registration, login, and account lifecycle for B2C and B2B experiences. You will implement OAuth 2.0, OIDC, SAML, and SCIM in code and ensure scalable, secure patterns across highly available distributed systems on AWS.

You will develop Python and Kotlin APIs, collaborate with partner teams, and own secure authentication, MFA, device binding, and adaptive authentication.