Senior Product Security Engineer - Remote with Equity

Affirm, Inc.; Baltimore (MD); Remote; USD 173,000 - 233,000; Full time

Benefits offered by this job

Health benefits for you and dependents

ESPP stock purchase plan

Monthly stipends for tech setup and健康/

Flexible time off

Job summary

Affirm, Inc. is seeking a Senior Product Security Engineer to partner with product and engineering teams to embed security across the development lifecycle.

You will conduct threat modeling, review architectures and code, and drive secure implementation across cloud-based services using Python, Kotlin, Java, AWS and Azure. We expect expertise in OWASP guidelines, PCI/regulatory environments, and modern CI/CD practices.

Qualifications

• BS degree in a related field required.
• MS degree in related field is a plus.
• Experience with OWASP/SANS security standards.
• Experience in PCI or other regulated environments.
• Experience conducting threat models for complex distributed products.
• Knowledge of SAML and OAuth2 authentication.
• Understanding of continuous integration and deployment processes.

Responsibilities

• Partner with product teams to include security in the product lifecycle.
• Perform threat modeling and architecture reviews to identify and mitigate threats.
• Review product source code to find security vulnerabilities and suggest secure implementations.
• Automate security processes where possible.
• Identify emerging vulnerabilities and develop proactive solutions.
• Help product teams develop security-focused test cases.
• Advise on business security requirements early in development.
• Decompose large cross-team projects into tasks and drive to closure.

Skills

Threat modeling

Security architecture

Code review

Web app security

Security tooling

Security testing

Education

Bachelor's degree in a related field

Master's degree in a related field

Tools

Python

Kotlin

Java

AWS

Azure

CI/CD

Job description

Affirm, Inc. is seeking a Senior Product Security Engineer to partner with product and engineering teams to embed security across the development lifecycle.

You will conduct threat modeling, review architectures and code, and drive secure implementation across cloud-based services using Python, Kotlin, Java, AWS and Azure. We expect expertise in OWASP guidelines, PCI/regulatory environments, and modern CI/CD practices.