Senior Product Security Engineer — Remote & Equity

Affirm, Inc.; Boise (ID); Remote; USD 173,000 - 255,000; Full time

Benefits offered by this job

100% medical coverage for you and your

dependents

Equity rewards

Monthly stipends for health, wellness,

tech spending

Generous holiday calendar

Job summary

Affirm, Inc. is seeking a Senior Product Security Engineer to partner with product and engineering teams to embed security across the product lifecycle.

You will assess threats, review code, and design secure, scalable architectures for our cloud-based services. The role requires deep knowledge of web app security, experience with Python/Kotlin/Java, SAML and OAuth2, and familiarity with PCI/regulatory environments.

Qualifications

• BS degree in related field (or equivalent experience)
• MS degree in related field a plus
• Extensive knowledge of web application security principles
• Experience with threat modeling and secure coding practices
• Familiarity with PCI or other regulated environments
• Strong understanding of authentication mechanisms (SAML, OAuth2)
• Experience with CI/CD and cloud-native deployments

Responsibilities

• Partner with product teams to embed security in the product lifecycle
• Conduct threat modeling and architecture reviews
• Review source code to identify security vulnerabilities and provide remediation guidance
• Automate security processes where possible
• Identify emerging vulnerabilities and develop proactive solutions
• Develop security-focused test cases with product teams
• Advise on business security requirements early in development
• Decompose large projects into manageable tasks and drive to closure

Skills

Threat modeling

Secure coding practices

CI/CD processes

Cross-functional collaboration

Cloud service experience

Education

BS degree in related field

MS degree in related field

Tools

Python

Kotlin

Java

AWS

Azure

SAML

OAuth2

Job description

Affirm, Inc. is seeking a Senior Product Security Engineer to partner with product and engineering teams to embed security across the product lifecycle.

You will assess threats, review code, and design secure, scalable architectures for our cloud-based services. The role requires deep knowledge of web app security, experience with Python/Kotlin/Java, SAML and OAuth2, and familiarity with PCI/regulatory environments.