Senior Product Security Engineer - Remote-First & Equity

Affirm, Inc.; Austin (TX); Remote; USD 173,000 - 255,000; Full time

Benefits offered by this job

100% premium coverage for employees &

Job summary

Affirm, Inc. is seeking a Senior Product Security Engineer to partner with product and engineering teams, shaping secure design and implementation across the lifecycle. The role emphasizes threat modeling, architecture reviews, and secure code analysis to strengthen affirm’s cloud-based services.

You’ll drive automation, address emerging vulnerabilities, and help embed security requirements early in development. This is a remote-first role with nationwide applicability in the United States.

Qualifications

• BS degree or equivalent experience; MS considered a plus.
• Experience conducting threat modeling for distributed products.
• Experience reviewing source code and secure implementation.
• Knowledge of OWASP, SANS and related security standards.

Responsibilities

• Partner with product teams to include security in every product lifecycle phase.
• Conduct threat modeling and architecture reviews to identify and mitigate threats.
• Review product source code to identify vulnerabilities and provide secure implementations.
• Automate security processes where possible.
• Identify emerging vulnerability classes and craft preventive solutions.
• Develop security-focused test cases to enforce requirements.

Skills

Web architecture

Threat modeling

CI/CD practices

Authentication (SAML/OAuth2)

Cloud services (AWS/Azure)

Programming (Python/Kotlin/Java)

Education

BS degree in related field or equivalent

MS degree in related field or equivalent

Tools

SAML

OAuth2

PCI compliance knowledge

Job description

Affirm, Inc. is seeking a Senior Product Security Engineer to partner with product and engineering teams, shaping secure design and implementation across the lifecycle. The role emphasizes threat modeling, architecture reviews, and secure code analysis to strengthen affirm’s cloud-based services.

You’ll drive automation, address emerging vulnerabilities, and help embed security requirements early in development. This is a remote-first role with nationwide applicability in the United States.