Senior Product Security Engineer — Remote-First

Affirm, Inc.; Richmond (VA); Remote; USD 173,000 - 233,000; Full time

Benefits offered by this job

Health coverage

Stock purchase plan

Tech stipends

Generous time off

Job summary

Affirm, Inc. is hiring a Senior Product Security Engineer to partner with product teams and embed security in the full product lifecycle. The role focuses on threat modeling, architecture reviews, and secure coding practices across cloud-based services.

The ideal candidate will analyze code for vulnerabilities, automate security processes, and guide teams on authentication standards like SAML and OAuth2. This remote-friendly role emphasizes scalable security across the organization.

Qualifications

• BS degree in a related field; MS degree a plus.
• Experience performing threat modeling for complex distributed products.
• Knowledge of modern web app architecture and security best practices.
• Familiarity with SAML/OAuth2 and secure authentication mechanisms.

Responsibilities

• Partner with product teams to bake security into the product lifecycle.
• Conduct threat modeling and architecture reviews to identify and mitigate risks.
• Review product source code to find vulnerabilities and provide secure implementations.
• Automate security processes where possible.
• Identify emerging vulnerabilities and propose proactive solutions.
• Help develop security-focused test cases to enforce requirements.
• Advise on business security requirements early in development.
• Decompose large projects and drive cross-team delivery to closure.

Skills

Threat modeling

Secure coding

Cloud security

Security reviews

CI/CD security

OWASP knowledge

Education

BS in related field

MS degree (plus)

Job description

Affirm, Inc. is hiring a Senior Product Security Engineer to partner with product teams and embed security in the full product lifecycle. The role focuses on threat modeling, architecture reviews, and secure coding practices across cloud-based services.

The ideal candidate will analyze code for vulnerabilities, automate security processes, and guide teams on authentication standards like SAML and OAuth2. This remote-friendly role emphasizes scalable security across the organization.