Senior Product Security Engineer

Affirm; New York (NY); Remote; USD 140,000 - 200,000; Full time

Benefits offered by this job

Remote-first compensation structure

Wallets for tech, food, lifestyle

Parental leave and wellbeing programs

Company-wide paid days off

Mental healthcare programs

Learning & Development programs

Job summary

Affirm, Inc. is seeking a Senior Product Security Engineer to help secure our growing product ecosystem. You will collaborate with product and engineering teams to influence requirements, design, and secure implementation across the development lifecycle.

You will conduct threat modeling, architecture reviews, and code reviews to identify vulnerabilities and drive secure solutions, while helping automate security processes and advance the organization's security posture.

Qualifications

• BS degree in related field or equivalent experience.
• Experience with PCI or other regulated environments.
• Experience with Python, Kotlin, Java, AWS, and Azure is preferred.
• Knowledge of common security flaws and resolutions per OWASP/SANS.

Responsibilities

• Partner with product teams to ensure security in all phases of SDLC.
• Conduct threat modeling and architecture reviews for complex distributed products.
• Review product source code to identify security vulnerabilities and provide secure implementation recommendations.
• Automate security processes where possible.
• Advise product teams on business security requirements early in development lifecycle.
• Decompose large cross-team projects into tasks and drive to closure.

Skills

Threat modeling

Architecture reviews

Secure SDLC

CI/CD processes

Programming languages: Python, Kotlin,

Java

OWASP knowledge

SAML/OAuth2

Cloud: AWS/Azure

Education

BS degree in related field

MS degree a plus

Tools

AWS

Azure

Job description

• The Senior Product Security Engineer candidate will have experience building and architecting software as part of a larger team. The ideal candidate will work effectively with product and engineering teams to evaluate and influence product requirements, design, and implementation to improve the security of Affirms products
• Partner with Affirms product teams to ensure that security is included in every phase of the product development lifecycle
• Conduct threat modeling and architecture reviews to ensure threats are understood, documented, and mitigated
• Review and analyze product source code to identify security vulnerabilities and provide recommendations for secure implementation
• Seek out opportunities to automate processes when appropriate
• Identify emerging classes of vulnerabilities and developing solutions for them before they’re a problem
• Assist product teams in the development of security focused test cases to enforce security requirements
• Advise product teams on business security requirements early in the product development lifecycle
• Decompose large, cross-team projects into individual tasks. Manage scope across teams and drive toward project closure

Benefits

• Compensation: We have a simple, flexible, and transparent remote-first compensation structure so you can make the best decisions for yourself and your family
• Spending Wallets: Access tech, food, lifestyle, and family planning wallets for your expenses
• Supportive Communities: Get involved with our employee resource groups and community groups
• Remote-first Workforce: If your role is remote, you can set up shop anywhere in your home country
• Generous Time Off: Take the time you need when life happens
• Health Benefits: Get a plan that fits your needs
• Mental Healthcare: Take care of your mind with great mental health programs
• Parental Leave: Birth and non-birth parents get 18 weeks’ paid leave. Plus, a 4-week return-to-work transition program, at full base pay
• Away Days: We offer 20 company-wide paid days off—which help our teams collectively pause to recharge
• Learning & Development: Engage in exciting learning programs to level up your growth

Deep understanding of web application architecture and design principlesBS degree in related field or equivalent experienceUnderstanding of continuous integration / continuous deployment processes and toolsExperience conducting threat models for complex, distributed products using standard threat modeling techniques and methodologiesExperience with PCI or other regulated environmentsMS degree in a related field or equivalent experience is a plusExperience with Python, Kotlin, Java, AWS, and Azure is preferredKnowledge of common security flaws and resolution as published by OWASP, SANS, etcExperience with standard authentication mechanisms, including SAML and OAuth2Experience using modern software development and delivery techniques to develop cloud-based services