Senior Product Security Engineer - Remote-First, Equity

Affirm, Inc.; Pittsburgh (Allegheny County); Remote; USD 173,000 - 255,000; Full time

Benefits offered by this job

Health coverage for you and dependents

ESPP stock purchase plan

Stipends for health, wellness, andTech

Job summary

Affirm, Inc. is seeking a Senior Product Security Engineer to collaborate with product and engineering teams to raise the security bar across products. You will evaluate requirements, influence design, and implement security improvements throughout the product lifecycle.

The role emphasizes threat modeling, code review, and automation, with a focus on web architectures, cloud services, and regulated environments. Remote-first with flexible in-person onboarding continues across the U.S.

Qualifications

• Experience securing web applications across the SDLC.
• Knowledge of OWASP, SANS, and secure coding practices.
• Experience with PCI or regulated environments.
• Familiarity with threat modeling methodologies and tools.

Responsibilities

• Partner with product teams to embed security in the development lifecycle.
• Conduct threat modeling and architecture reviews to identify mitigations.
• Review product source code to identify vulnerabilities and provide fixes.
• Automate security processes where possible.
• Develop security-focused test cases with product teams.
• Advise on business security requirements early in product development.
• Break down large projects into manageable tasks and drive delivery.

Skills

Web security

Threat modeling

Code review

CI/CD

Authentication (SAML/OAuth2)

Cloud platforms

Education

BS degree in a related field

MS degree in a related field

Tools

Python

Kotlin

Java

AWS

Azure

Job description

Affirm, Inc. is seeking a Senior Product Security Engineer to collaborate with product and engineering teams to raise the security bar across products. You will evaluate requirements, influence design, and implement security improvements throughout the product lifecycle.

The role emphasizes threat modeling, code review, and automation, with a focus on web architectures, cloud services, and regulated environments. Remote-first with flexible in-person onboarding continues across the U.S.