Staff CIAM Backend Engineer - Remote

Affirm; Charlotte (NC); On-site; USD 204,000 - 290,000; Full time

Benefits offered by this job

Health care coverage for you and your

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is building the next generation of customer identity and authentication, shipping core CIAM backends for B2C and B2B. You will own end-to-end authentication flows, device binding, MFA, and adaptive authentication, while integrating with internal systems and external CIAM platforms.

We operate a remote-first model with some offices; strong security and reliability are core as we scale globally. Expect collaboration with global teams, rigorous design and coding standards, and ownership of

Qualifications

• 7+ years designing, developing and launching CIAM backends at scale.
• Strong experience with OAuth 2.0, OIDC, SAML, and SCIM beyond basics.
• Proficient in Python or Kotlin for backend services.
• Experience with AWS, relational databases, and data tooling.
• Hands-on API design, distributed systems, and IAM security.
• Experience building CI/CD pipelines and IaC deployments.

Responsibilities

• Design, build, and operate CIAM backends for registration, auth, and profile management.
• Implement identity standards across services with scalable patterns.
• Develop APIs and services for web, mobile, and partner apps.
• Integrate CIAM with data stores, messaging, and fraud signals.
• Own secure authentication flows, MFA, and adaptive auth logic.
• Automate infrastructure and deployments via IaC and CI/CD.

Skills

Backend design

Distributed systems

Python

Kotlin

AWS

MySQL

Spark

Kubernetes

OAuth 2.0 / OIDC / SAML / SCIM

API design

CI/CD pipelines

Security fundamentals

GitHub workflows / Buildkite

Terraform / IaC

CIAM tooling (Okta/Auth0/Ping Identity

Cursor / AI-augmented dev tools

Tools

Okta

Auth0

Ping Identity

ForgeRock

Azure AD B2C

Job description

Affirm is building the next generation of customer identity and authentication, shipping core CIAM backends for B2C and B2B. You will own end-to-end authentication flows, device binding, MFA, and adaptive authentication, while integrating with internal systems and external CIAM platforms.

We operate a remote-first model with some offices; strong security and reliability are core as we scale globally. Expect collaboration with global teams, rigorous design and coding standards, and ownership of