Staff CIAM Backend Engineer - Remote

Affirm; Palo Alto (CA); On-site; USD 230,000 - 290,000; Full time

Benefits offered by this job

Health care coverage

Employee stock purchase plan (ESPP)

Stipends for health, wellness and tech

Time off

Job summary

Affirm is hiring for a hands-on CIAM backend engineer to design and ship core identity capabilities powering registration, login, and account lifecycle for B2C and B2B. You will build backend services in Python and Kotlin, integrate with AWS, MySQL, Spark, and Kubernetes, and implement OAuth 2.0, OIDC, SAML, and SCIM with secure, scalable patterns.

This remote-first role emphasizes strong security fundamentals, reliability, and operational rigor, with collaboration across global teams and

Qualifications

• 7+ years of experience designing, developing and launching backend systems at scale using languages like Python or Kotlin.
• Extensive track record of developing highly available distributed systems using AWS, MySQL, Spark and Kubernetes.
• Strong communication skills for collaboration with global engineering teams.
• Experience delivering major features and writing high-quality code.
• Design, build, and operate CIAM backend services for B2C and B2B platforms.
• Implement and extend identity standards (OAuth 2.0, OIDC, SAML, SCIM) in code.

Responsibilities

• Design, build, and operate CIAM backend services supporting registration, authentication, authorization, and account lifecycle.
• Develop APIs and services in Python and Kotlin for web, mobile, and partner apps.
• Integrate CIAM platforms with internal systems and data stores.
• Own secure authentication flows including MFA, step-up auth, device binding, consent, and adaptive auth.
• Automate CIAM infrastructure with IaC and CI/CD pipelines.
• Monitor, debug, and optimize CIAM services for performance and resilience.

Skills

Python

Kotlin

AWS

MySQL

Spark

Kubernetes

OAuth 2.0

OIDC

SAML

SCIM

Tools

GitHub

Buildkite

Terraform

Job description

Affirm is hiring for a hands-on CIAM backend engineer to design and ship core identity capabilities powering registration, login, and account lifecycle for B2C and B2B. You will build backend services in Python and Kotlin, integrate with AWS, MySQL, Spark, and Kubernetes, and implement OAuth 2.0, OIDC, SAML, and SCIM with secure, scalable patterns.

This remote-first role emphasizes strong security fundamentals, reliability, and operational rigor, with collaboration across global teams and