Senior Product Security Engineer - Remote-First

Affirm, Inc.; Denver (CO); Remote; USD 173,000 - 233,000; Full time

Benefits offered by this job

100% subsidized medical coverage for员工

Monthly health, wellness and tech stip

Equity via ESPP

Flexible time off

Job summary

Affirm, Inc. is hiring a Senior Product Security Engineer to partner with product teams, model threats, and review code to improve security across its cloud-based services.

You will drive secure design decisions and help implement automated security processes within a remote-first environment. The role emphasizes collaboration with engineering and product teams, deep knowledge of web architectures, and experience with modern security practices such as OAuth2/SAML, PCI, and CI/CD.

Qualifications

• BS degree in related field or equivalent experience; MS considered a plus.
• Experience with threat modeling for complex distributed products.
• Knowledge of OWASP and industry security standards.
• Experience with secure software development lifecycle practices.

Responsibilities

• Partner with product teams to include security in all phases of development lifecycle.
• Conduct threat modeling and architecture reviews to identify and mitigate threats.
• Review source code for vulnerabilities and recommend secure implementations.
• Automate security processes where possible.
• Identify new classes of vulnerabilities and propose solutions.
• Develop security-focused test cases with product teams.
• Advise on business security requirements early in development lifecycle.
• Decompose large projects into tasks and drive cross-team delivery.

Skills

Web app architecture

Threat modeling

CI/CD

OAuth2 / SAML

Cloud services (AWS/Azure)

Python / Kotlin / Java

Education

BS degree or equivalent

MS degree (plus)

Job description

Affirm, Inc. is hiring a Senior Product Security Engineer to partner with product teams, model threats, and review code to improve security across its cloud-based services.

You will drive secure design decisions and help implement automated security processes within a remote-first environment. The role emphasizes collaboration with engineering and product teams, deep knowledge of web architectures, and experience with modern security practices such as OAuth2/SAML, PCI, and CI/CD.