Senior Product Security Engineer — Remote-First & High-Impact

Affirm, Inc.; Minneapolis (MN); Remote; USD 173,000 - 255,000; Full time

Benefits offered by this job

100% subsidized medical coverage

Tech stipends and ESPP

Job summary

Affirm, Inc. is seeking a Senior Product Security Engineer to partner with product and engineering teams, shaping secure product design, threat modeling, and code analysis. You’ll drive automated security processes and guide cross-team security requirements across the SDLC.

You will assess architecture, review source code for vulnerabilities, and advise on best practices for secure product delivery in a remote-first environment across the United States.

Qualifications

• Deep understanding of web application architecture and design principles.
• Experience with modern development for cloud-based services (Python, Kotlin, Java, AWS, Azure).
• Knowledge of OWASP, SANS and related security guidelines.
• Experience with PCI or other regulated environments.
• Experience conducting threat models for complex distributed products.
• Experience with SAML and OAuth2 authentication mechanisms.
• Understanding of CI/CD processes and tooling.

Responsibilities

• Partner with product teams to embed security in the full development lifecycle.
• Conduct threat modeling and architecture reviews to identify and mitigate risks.
• Review code to identify security vulnerabilities and recommend secure implementations.
• Automate security processes where possible.
• Identify emerging vulnerabilities and develop proactive solutions.
• Develop security-focused test cases with product teams.
• Advise on business security requirements early in development.
• Decompose large projects and drive cross-team delivery to closure.

Skills

Web security

Threat modeling

Security architecture

Cloud security

CI/CD

Python

SAML/OAuth2

Education

BS degree in related field

MS degree in related field

Tools

AWS

Azure

Job description

Affirm, Inc. is seeking a Senior Product Security Engineer to partner with product and engineering teams, shaping secure product design, threat modeling, and code analysis. You’ll drive automated security processes and guide cross-team security requirements across the SDLC.

You will assess architecture, review source code for vulnerabilities, and advise on best practices for secure product delivery in a remote-first environment across the United States.