Senior CIAM Security Engineer – Remote Identity Platform

Affirm; Denver (CO); On-site; USD 204,000 - 290,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is a remote-first company redefining credit through transparent, consumer-friendly payment options. This hands-on engineering role sits in Information Security, focused on CIAM capabilities that protect customers and enable growth.

You will build and operate backend services powering registration, login, authorization, and account lifecycle flows across B2C and B2B, with strong emphasis on OAuth/OIDC/SAML/SCIM integration, security, reliability, and scalability.

Qualifications

• 7+ years of experience designing, developing and launching backend systems at scale.
• Extensive track record of developing highly available distributed systems.
• Strong knowledge of OAuth 2.0, OIDC, SAML, and SCIM beyond basic configuration.
• Experience delivering major features and writing high quality, reusable code.

Responsibilities

• Design, build, and operate CIAM backend services for registration, authentication, authorization, and account lifecycle for B2C and B2B.
• Implement and extend identity standards (OAuth 2.0, OIDC, SAML, SCIM) in code.
• Develop backend APIs in Python and Kotlin exposing identity capabilities to web, mobile, and partner apps.

Skills

CIAM design

Backend development

Python/Kotlin

AWS

Distributed systems

OAuth 2.0 / OIDC / SAML / SCIM

API design

CI/CD pipelines

Security fundamentals

Communication

Tools

AWS

MySQL

Spark

Kubernetes

Terraform

Buildkite

GitHub workflows

Okta / Auth0 / Ping Identity

Job description

Affirm is a remote-first company redefining credit through transparent, consumer-friendly payment options. This hands-on engineering role sits in Information Security, focused on CIAM capabilities that protect customers and enable growth.

You will build and operate backend services powering registration, login, authorization, and account lifecycle flows across B2C and B2B, with strong emphasis on OAuth/OIDC/SAML/SCIM integration, security, reliability, and scalability.