Senior Product Security Engineer: Threat Modeling & Remote

Affirm, Inc.; New York (NY); Remote; USD 195,000 - 255,000; Full time

Benefits offered by this job

Health coverage for employees and our/

Monthly tech stipends

Generous time off & holidays

Employee stock purchase plan (ESPP)

Job summary

Affirm, Inc. is seeking a Senior Product Security Engineer to partner with product teams, perform threat modeling, and secure code reviews to strengthen the security of Affirm’s products.

You will influence requirements and implementation with engineering teams, and help automate security processes to reduce risk. The role emphasizes cloud-based services with Python, Kotlin, and Java, and requires deep knowledge of web architectures, OAuth2/SAML, and PCI-related environments.

Qualifications

• BS degree in related field; MS degree a plus.
• Experience securing software product lifecycles in a fast-moving environment.
• Knowledge of OWASP, SANS and common security frameworks.

Responsibilities

• Partner with product teams to ensure security in every product lifecycle phase.
• Conduct threat modeling and architecture reviews to identify and mitigate threats.
• Review product source code to identify vulnerabilities and provide secure implementation recommendations.
• Automate security processes where appropriate.
• Identify emerging classes of vulnerabilities and develop proactive solutions.
• Assist product teams in developing security-focused test cases for requirements.
• Advise on business security requirements early in development.
• Decompose large cross-team projects into tasks and drive to closure.

Skills

Python

Kotlin

Java

AWS

Azure

Education

BS degree in related field

MS degree in related field

Tools

Security tooling

Job description

Affirm, Inc. is seeking a Senior Product Security Engineer to partner with product teams, perform threat modeling, and secure code reviews to strengthen the security of Affirm’s products.

You will influence requirements and implementation with engineering teams, and help automate security processes to reduce risk. The role emphasizes cloud-based services with Python, Kotlin, and Java, and requires deep knowledge of web architectures, OAuth2/SAML, and PCI-related environments.