Senior Product Security Engineer — Threat Modeling & Secure SDLC

Affirm, Inc.; Charlotte (NC); Remote; USD 173,000 - 255,000; Full time

Benefits offered by this job

Remote-first company

100% subsidized medical coverage

Employee stock purchase plan (ESPP)

Job summary

Affirm is seeking a Senior Product Security Engineer to partner with product and engineering teams to bake security into the product lifecycle. You will perform threat modeling, architecture reviews, and secure code reviews across Python, Java/Kotlin services in AWS/Azure.

You’ll help automate security processes and guide teams on secure requirements from early design through release. In this remote-first role, you will work across US-based teams with competitive pay and a comprehensive benefits

Qualifications

• BS/MS in Computer Science, Information Security, or related field.
• Experience applying secure development life cycle to web-based products.
• Familiarity with cloud platforms (AWS, Azure) and securing distributed systems.

Responsibilities

• Partner with product and engineering teams to include security in all product phases.
• Conduct threat modeling and architecture reviews to identify and mitigate threats.
• Review source code to identify vulnerabilities and provide secure implementation guidance.
• Automate security processes where possible to improve efficiency.
• Identify new classes of vulnerabilities and craft proactive solutions.
• Assist teams in developing security-focused test cases to enforce requirements.
• Advise on business security requirements early in the lifecycle.
• Decompose cross-team projects into tasks and drive to closure.

Skills

Threat modeling

Web application security

Python

Java

Kotlin

AWS

Azure

OWASP knowledge

PCI compliance

SAML/OAuth2

CI/CD security

Security architecture

Education

BS degree in related field

MS degree in related field

Job description

Affirm is seeking a Senior Product Security Engineer to partner with product and engineering teams to bake security into the product lifecycle. You will perform threat modeling, architecture reviews, and secure code reviews across Python, Java/Kotlin services in AWS/Azure.

You’ll help automate security processes and guide teams on secure requirements from early design through release. In this remote-first role, you will work across US-based teams with competitive pay and a comprehensive benefits