At Affirm, security is integral to our mission of building honest financial products and driving the company's long-term success. The Security Operations and Resilience Engineering (SOR) program serves as the foundation of our preventive and responsive efforts to safeguard Affirm's assets and infrastructure. As part of our Security Team, you'll join a group of passionate, highly skilled professionals redefining fintech security through collaboration, innovation, and a team-first mindset.

We're seeking a Senior Security Operations Engineer to join the Incident Response function within the broader Security Operations & Resilience org. In this role, you'll be a hands-on practitioner and technical contributor who drives incident response efforts from triage through resolution - with the depth, ownership, and composure to lead when it matters most.

This is a highly technical, execution-focused role where you’ll lead hands-on investigations and drive incident response from detection through remediation. You’ll collaborate across engineering, product, and infrastructure teams, and partner with Observability & Automation to improve detections, build automated playbooks, and strengthen our security posture. You will have the opportunity to help solve complex security challenges and build capabilities that protect millions of customers, merchants, and partners.

What you’ll do

You will lead and execute incident response efforts to protect Affirm’s systems, customers, and data.

• Lead security incidents end-to-end, from detection and triage through containment, remediation, and post-incident review. 

• Act as incident commander, driving clear decisions and alignment across teams during high-pressure situations. 

• Conduct hands-on investigations across cloud and endpoint environments to determine root cause and impact. 

• Partner with Observability & Automation to improve detections, reduce noise, and build automated response playbooks. 

• Contribute to and refine incident response playbooks, runbooks, and documentation to improve readiness and consistency. 

• Collaborate with Security, Infrastructure, and Product teams to identify gaps and strengthen the incident response lifecycle. 

• Communicate effectively during incidents, providing clear updates to both technical and non-technical stakeholders. 

What we look for

We’re looking for a hands-on security engineer who can lead through ambiguity and drive effective incident response outcomes.

• 5+ years of experience in Security Operations or Detection & Response, with strong hands-on incident response in cloud environments (AWS and EKS experience strongly preferred).

• Proven ability to lead security incidents, including containment and remediation, in fast-moving environments. 

• Strong investigative and analytical skills, with the ability to synthesize signals from multiple data sources. 

• Experience with security tooling such as SIEM and EDR platforms (e.g., Splunk, Elastic, SentinelOne, CrowdStrike, or similar). 

• Solid understanding of cloud security concepts and their application in real-world scenarios. 

• Strong communication skills, with the ability to clearly convey information across technical and non-technical audiences. 

• Experience building or improving automation for incident response workflows (e.g., scripting in Python; infrastructure-as-code is a plus). 

Location - Remote CAN

Pay Grade - N
Equity Grade - 6

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, which includes the annual base pay and the sales incentive target.

Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).

Base pay range per year: $150,000 - $200,000 CAD

#LI-Remote

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest.

Affirm values information security as a critical part of the company’s continued success. Our mission is to make information security programmatic and cultural in Affirm, enabling the company to succeed in building honest financial products. The Security team posture increases security and reduces risk while securely enabling access to information for those who need it!

The Senior Product Security Engineer candidate will have experience building and architecting software as part of a larger team. The ideal candidate will work effectively with product and engineering teams to evaluate and influence product requirements, design, and implementation to improve the security of Affirm’s products.

What You'll Do

• Partner with Affirm product teams to ensure that security is included in every phase of the product development lifecycle.
• Conduct threat modeling and architecture reviews to ensure threats are understood, documented, and mitigated.
• Review and analyze product source code to identify security vulnerabilities and provide recommendations for secure implementation.
• Seek out opportunities to automate processes when appropriate.
• Identify emerging classes of vulnerabilities and developing solutions for them before they’re a problem.
• Assist product teams in the development of security focused test cases to enforce security requirements.
• Advise product teams on business security requirements early in the product development lifecycle.
• Decompose large, cross-team projects into individual tasks. Manage scope across teams and drive toward project closure.

What We Look For

• Deep understanding of web application architecture and design principles
• Experience using modern software development and delivery techniques to develop cloud-based services. Python, Kotlin, Java, AWS, and Azure experience preferred.
• Knowledge of common security flaws and resolution as published by OWASP, SANS, etc.
• Experience with PCI or other regulated environments. 
• Experience conducting threat models for complex, distributed products using standard threat modeling techniques and methodologies.
• Experience with standard authentication mechanisms, including SAML and OAuth2.
• Understanding of continuous integration / continuous deployment processes and tools.
• BS degree in related field or equivalent experience. MS degree in a related field or equivalent experience is a plus.

Location - Remote Canada

Pay Grade - N
Equity Grade - 06

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).

Base pay range per year: $150,000 - $200,000 

Affirm is building the next generation of customer identity and authentication. This role is a hands-on engineering position inside Information Security, focused on designing and shipping core CIAM capabilities that protect customers and support growth.

You will build and operate backend services that power registration, login, authorization, and account lifecycle flows across B2C and B2B experiences. You will work closely with partner engineering teams and ensure identity features are delivered with strong security fundamentals, reliability, and operational rigor.

What you’ll do

• Design, build, and operate core CIAM backend services that support customer registration, authentication, authorization, account lifecycle, and profile management for B2C and B2B platforms.
• Implement and extend identity standards such as OAuth 2.0, OIDC, SAML, and SCIM in code, ensuring correctness, scalability, and clean integration patterns.
• Develop backend APIs and services in Python and Kotlin that expose identity capabilities to web, mobile, and partner applications.
• Integrate CIAM platforms with internal systems, including user data stores, messaging, fraud signals, and downstream customer platforms.
• Own secure authentication and account flows end to end, including MFA, step-up authentication, device binding, consent, and adaptive authentication logic.
• Automate CIAM infrastructure and deployments using Infrastructure as Code and CI/CD pipelines, treating identity as a core platform service.
• Monitor, debug, and optimize CIAM services for performance, resilience, and abuse detection in high-scale environments.

What we look for

• Strong experience designing and implementing CIAM systems, with deep, hands-on knowledge of OAuth 2.0, OIDC, SAML, and SCIM beyond basic configuration.
• 5+ years of professional backend software engineering experience
• Strong production experience in Python or a similar backend language
• Experience designing APIs, automation frameworks, and distributed systems
• Hands-on experience building and maintaining CI/CD pipelines
• Experience with GitHub-based development workflows and Buildkite or similar build systems
• Experience with cloud-native development, preferably AWS
• Hands-on experience extending and integrating CIAM platforms such as Okta, Auth0, Ping Identity, ForgeRock, or Azure AD B2C using custom code, hooks, and APIs.
• Solid understanding of backend and distributed systems fundamentals, including API design, data modeling, latency, error handling, and observability.
• Experience with Infrastructure as Code and automation tools such as Terraform, plus CI/CD pipelines for deploying backend services.
• Strong security fundamentals applied through engineering, including access control models, token handling, encryption, MFA, and privacy by design.
• Clear communication skills and the ability to work closely with product, frontend, mobile, and security teams while owning backend identity services.
• Familiarity with tools such as Cursor and other AI-augmented development environments

Base Pay Grade - N

Equity Grade - Canada 6

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills. 

Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).

CAN base pay range per year: $150,000 - $200,000

This posting is for an existing vacancy

#LI-Remote

Affirm is building the next generation of customer identity and authentication. This role is a hands-on engineering position inside Information Security, focused on designing and shipping core CIAM capabilities that protect customers and support growth.

You will build and operate backend services that power registration, login, authorization, and account lifecycle flows across B2C and B2B experiences. You will work closely with partner engineering teams and ensure identity features are delivered with strong security fundamentals, reliability, and operational rigor.

What you’ll do

• Design, build, and operate core CIAM backend services that support customer registration, authentication, authorization, account lifecycle, and profile management for B2C and B2B platforms.
• Implement and extend identity standards such as OAuth 2.0, OIDC, SAML, and SCIM in code, ensuring correctness, scalability, and clean integration patterns.
• Develop backend APIs and services in Python and Kotlin that expose identity capabilities to web, mobile, and partner applications.
• Integrate CIAM platforms with internal systems, including user data stores, messaging, fraud signals, and downstream customer platforms.
• Own secure authentication and account flows end to end, including MFA, step-up authentication, device binding, consent, and adaptive authentication logic.
• Automate CIAM infrastructure and deployments using Infrastructure as Code and CI/CD pipelines, treating identity as a core platform service.
• Monitor, debug, and optimize CIAM services for performance, resilience, and abuse detection in high-scale environments.

What we look for

• Strong experience designing and implementing CIAM systems, with deep, hands-on knowledge of OAuth 2.0, OIDC, SAML, and SCIM beyond basic configuration.
• 5+ years of professional backend software engineering experience
• Strong production experience in Python or a similar backend language
• Experience designing APIs, automation frameworks, and distributed systems
• Hands-on experience building and maintaining CI/CD pipelines
• Experience with GitHub-based development workflows and Buildkite or similar build systems
• Experience with cloud-native development, preferably AWS
• Hands-on experience extending and integrating CIAM platforms such as Okta, Auth0, Ping Identity, ForgeRock, or Azure AD B2C using custom code, hooks, and APIs.
• Solid understanding of backend and distributed systems fundamentals, including API design, data modeling, latency, error handling, and observability.
• Experience with Infrastructure as Code and automation tools such as Terraform, plus CI/CD pipelines for deploying backend services.
• Strong security fundamentals applied through engineering, including access control models, token handling, encryption, MFA, and privacy by design.
• Clear communication skills and the ability to work closely with product, frontend, mobile, and security teams while owning backend identity services.
• Familiarity with tools such as Cursor and other AI-augmented development environments

Base Pay Grade - N

Equity Grade - USA 8

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include equity rewards, monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents.)

USA base pay range (CA, WA, NY, NJ, CT) per year: $190,000 - $240,000
USA base pay range (all other U.S. states) per year: $169,000 - $219,000

#LI-Remote

We are building the next generation of Identity and Access Management at Affirm. This role is ideal for someone who wants to break into IAM and blend software engineering skills with process-driven operations.

You will support the day-to-day operations of our enterprise IAM program while also contributing to scripting, bug fixes, and backend coding. This is intentionally a 50/50 role: half focused on operational process and execution, and half focused on technical delivery.

SailPoint is the core systems in our environment. You will work directly within SailPoint and the surrounding automation and integration code.

What You’ll Do

• Support the daily operations of our enterprise IAM program, including intake, triage, and execution of access lifecycle work
• Run and improve core IAM processes (joiner/mover/leaver, access requests, certifications, and break-glass patterns)
• Partner with Security, IT, and Engineering stakeholders to coordinate changes with clear ownership, approvals, and auditability
• Troubleshoot and resolve IAM-related issues, including access failures, provisioning bugs, and workflow errors
• Write and maintain scripts and small services that automate repetitive IAM tasks and reduce manual effort
• Contribute backend code and bug fixes in our IAM automation codebase (including tests and safe rollout practices)
• Help document runbooks, standard operating procedures, and operational metrics for the program
• Participate in on-call or escalation rotations as needed for IAM-owned systems

Example problems you may work on:

• Debugging a provisioning workflow that intermittently fails and adding monitoring + automated retries
• Writing a script to reconcile access between source systems and SailPoint
• Improving a Jira intake workflow so requests are validated and routed correctly before execution
• Building a small API integration to connect an internal system to identity lifecycle events

What We’re Looking For

• 2+ years of professional software engineering experience (or equivalent internship/co-op experience with strong projects)
• Ability to write production-quality code in Python or a similar backend language
• Comfort working with operational processes, tickets/requests, and cross-functional stakeholders
• Experience with APIs, scripting, and debugging distributed systems issues
• Familiarity with CI/CD and GitHub-based workflows
• Familiarity with cloud environments (AWS preferred)
• Strong written communication and documentation habits

Nice to Have

• Any exposure to IAM/IGA/SSO concepts (e.g., SAML/OIDC, SCIM, RBAC)
• Experience with SailPoint, Auth0, Okta, OneLogin, or similar identity platforms
• Experience with infrastructure as code (Terraform or similar)
• Familiarity with compliance/audit-driven environments (SOC 2, SOX, ISO, PCI)

Base Pay Grade - L

Equity Grade - Canada 5

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills. [IF APPLICABLE] For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, which includes the annual base pay and the sales incentive target.

Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).

CAN base pay range per year: $125,000 - $175,000

#LI-Remote

We’re hiring a Senior Manager to lead Security Governance and the Security Third-Party Risk Management (TPRM) function. This role owns program strategy, operational maturity, and stakeholder alignment for security governance, vendor risk, and third-party integration risk. The manager will drive policy and control frameworks, remediate audit findings, deliver measurable program KPIs, and grow a high-performing team that executes vendor diligence, monitoring, and governance at scale.

Our Security Governance and TPRM programs must move from tactical firefighting to predictable, measurable operations that scale with the business. This leader will set the security risk posture, tighten governance and fourth-party oversight, improve tooling and automation adoption, and ensure timely, actionable escalations so senior leadership can make the right business decisions.

What You'll Do

Program strategy & governance

• Own Security Governance: maintain and evolve security policies, standards, and control frameworks (e.g., NIST CSF, ISO 27001), including mapping to controls and compliance requirements (SOC2, PCI, applicable regulations).
• Lead program maturity planning, roadmaps, and cross-functional governance forums (e.g., security steering committee, risk council).
• Define and enforce security risk appetite and decision criteria for third-party relationships and integrations.

Third-party risk management

• Lead the Security TPRM function across vendor lifecycle: intake/onboarding, due diligence (IRQ/DDQ/SME reviews), contracting handoffs, ongoing monitoring, periodic reviews, and offboarding.
• Ensure robust fourth-party oversight, including subprocessors, and manage remediation/QA cycles driven by Internal Audit and regulators.
• Oversee high-risk vendor decisions and escalations; establish clear RACI for partnership contracts and security acceptance criteria.

Operational excellence & tooling

• Own program KPIs, dashboards, and reporting (Jira STPRM Ops, AuditBoard, Sigma/BI, MetricStream). Drive improvements in throughput, turnaround, backlog age, and remediation velocity.
• Partner with Automation/TPRM Ops to operationalize threat-modeling outputs, integration inventories, pre-integration gates, and CI/CD checks; prioritize automations that reduce manual work and surface strategic escalations.
• Implement and maintain QA processes (quarterly QA), runbooks, SOPs for ticket ownership, and evidence standards.

People & stakeholder leadership

• Build, coach, and scale the Governance and TPRM teams: hiring, performance management, career development, and team morale.
• Act as the primary security contact for Legal, Procurement, Privacy, Product, and Engineering on vendor risk and governance matters.
• Represent Security in executive forums, audit meetings, and regulatory engagements; own remediation commitments and timelines.

Audit, compliance & risk reporting

• Serve as the security liaison for Internal Audit and external assessments; ensure timely remediation of findings and demonstrable progress.
• Produce regular program health reporting for senior leadership and Board-level stakeholders.

Success metrics (examples)

• Vendors reviewed per month and % critical vendors reviewed on schedule
• Average review turnaround time and backlog age distribution
• % tickets with clear owner and SLA met
• Time to remediate Internal Audit findings and completion rate
• Implementation count of automated checks/runbooks and pre-integration gates
• Team engagement / retention and time-to-productivity for new hires

What We Look For

• 7+ years in information security, risk management, or GRC roles, with a minimum of 3 years managing teams (or equivalent leadership experience).
• Demonstrated ownership of a TPRM program or security governance program in a regulated or high-growth technology environment (fintech preferred).
• Strong knowledge of security frameworks (NIST, ISO), compliance standards (SOC2, PCI), and vendor risk processes (IRQ/DDQ/SME assessments).
• Hands-on familiarity with TPRM/GRC tooling and observability: AuditBoard (or equivalent), Jira, BI tools (Sigma/Tableau/Looker), and experience with integrations/APIs.
• Excellent stakeholder management across legal, procurement, engineering, product, and executive leadership.
• Proven experience translating audit findings into operational remediation plans and measurable outcomes.
• Strong communication skills — able to present risk to technical and non-technical audiences and to influence decisions.
• Certifications such as CISSP, CISM, CRISC, or similar.
• Practical experience with threat-modeling approaches and third-party integration security (API, SSO/OAuth/SAML, TLS).
• Experience scaling automation for GRC/TPRM programs and integrating security checks into CI/CD pipelines.
• Prior experience in fintech or highly regulated industries.

This posting is for an existing vacancy.

Pay Grade - Q
Equity Grade - 6

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include equity rewards, monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents.)

CAN base pay range per year: $198,000 - $248,000


#LI-Remote

We’re hiring a Senior Manager to lead Security Governance and the Security Third-Party Risk Management (TPRM) function. This role owns program strategy, operational maturity, and stakeholder alignment for security governance, vendor risk, and third-party integration risk. The manager will drive policy and control frameworks, remediate audit findings, deliver measurable program KPIs, and grow a high-performing team that executes vendor diligence, monitoring, and governance at scale.

Our Security Governance and TPRM programs must move from tactical firefighting to predictable, measurable operations that scale with the business. This leader will set the security risk posture, tighten governance and fourth-party oversight, improve tooling and automation adoption, and ensure timely, actionable escalations so senior leadership can make the right business decisions.

What You'll Do

Program strategy & governance

• Own Security Governance: maintain and evolve security policies, standards, and control frameworks (e.g., NIST CSF, ISO 27001), including mapping to controls and compliance requirements (SOC2, PCI, applicable regulations).
• Lead program maturity planning, roadmaps, and cross-functional governance forums (e.g., security steering committee, risk council).
• Define and enforce security risk appetite and decision criteria for third-party relationships and integrations.

Third-party risk management

• Lead the Security TPRM function across vendor lifecycle: intake/onboarding, due diligence (IRQ/DDQ/SME reviews), contracting handoffs, ongoing monitoring, periodic reviews, and offboarding.
• Ensure robust fourth-party oversight, including subprocessors, and manage remediation/QA cycles driven by Internal Audit and regulators.
• Oversee high-risk vendor decisions and escalations; establish clear RACI for partnership contracts and security acceptance criteria.

Operational excellence & tooling

• Own program KPIs, dashboards, and reporting (Jira STPRM Ops, AuditBoard, Sigma/BI, MetricStream). Drive improvements in throughput, turnaround, backlog age, and remediation velocity.
• Partner with Automation/TPRM Ops to operationalize threat-modeling outputs, integration inventories, pre-integration gates, and CI/CD checks; prioritize automations that reduce manual work and surface strategic escalations.
• Implement and maintain QA processes (quarterly QA), runbooks, SOPs for ticket ownership, and evidence standards.

People & stakeholder leadership

• Build, coach, and scale the Governance and TPRM teams: hiring, performance management, career development, and team morale.
• Act as the primary security contact for Legal, Procurement, Privacy, Product, and Engineering on vendor risk and governance matters.
• Represent Security in executive forums, audit meetings, and regulatory engagements; own remediation commitments and timelines.

Audit, compliance & risk reporting

• Serve as the security liaison for Internal Audit and external assessments; ensure timely remediation of findings and demonstrable progress.
• Produce regular program health reporting for senior leadership and Board-level stakeholders.

Success metrics (examples)

• Vendors reviewed per month and % critical vendors reviewed on schedule
• Average review turnaround time and backlog age distribution
• % tickets with clear owner and SLA met
• Time to remediate Internal Audit findings and completion rate
• Implementation count of automated checks/runbooks and pre-integration gates
• Team engagement / retention and time-to-productivity for new hires

What We Look For

• 7+ years in information security, risk management, or GRC roles, with a minimum of 3 years managing teams (or equivalent leadership experience).
• Demonstrated ownership of a TPRM program or security governance program in a regulated or high-growth technology environment (fintech preferred).
• Strong knowledge of security frameworks (NIST, ISO), compliance standards (SOC2, PCI), and vendor risk processes (IRQ/DDQ/SME assessments).
• Hands-on familiarity with TPRM/GRC tooling and observability: AuditBoard (or equivalent), Jira, BI tools (Sigma/Tableau/Looker), and experience with integrations/APIs.
• Excellent stakeholder management across legal, procurement, engineering, product, and executive leadership.
• Proven experience translating audit findings into operational remediation plans and measurable outcomes.
• Strong communication skills — able to present risk to technical and non-technical audiences and to influence decisions.
• Certifications such as CISSP, CISM, CRISC, or similar.
• Practical experience with threat-modeling approaches and third-party integration security (API, SSO/OAuth/SAML, TLS).
• Experience scaling automation for GRC/TPRM programs and integrating security checks into CI/CD pipelines.
• Prior experience in fintech or highly regulated industries.

Pay Grade - Q
Equity Grade - 10

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include equity rewards, monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents.)

USA base pay range (CA, WA, NY, NJ, CT) per year: $250,000 - $300,000
USA base pay range (all other U.S. states) per year: $223,000 - $273,000

#LI-Remote

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest.

Affirm values information security as a critical part of the company’s continued success. Our mission is to make information security programmatic and cultural in Affirm, enabling the company to succeed in building honest financial products. The Security team posture increases security and reduces risk while securely enabling access to information for those who need it!

The Staff Product Security Engineer candidate will have experience building and architecting software as part of a larger team. The ideal candidate will work effectively with product and engineering teams to evaluate and influence product requirements, design, and implementation to improve the security of Affirm’s products.

What You'll Do

• Partner with Affirm product teams to ensure that security is included in every phase of the product development lifecycle.
• Conduct threat modeling and architecture reviews to ensure threats are understood, documented, and mitigated.
• Review and analyze product source code to identify security vulnerabilities and provide recommendations for secure implementation.
• Seek out opportunities to automate processes when appropriate.
• Identify emerging classes of vulnerabilities and developing solutions for them before they’re a problem.
• Assist product teams in the development of security focused test cases to enforce security requirements.
• Advise product teams on business security requirements early in the product development lifecycle.
• Decompose large, cross-team projects into individual tasks. Manage scope across teams and drive toward project closure.

What We Look For

• Deep understanding of web application architecture and design principles
• Experience using modern software development and delivery techniques to develop cloud-based services. Python, Kotlin, Java, AWS, and Azure experience preferred.
• Knowledge of common security flaws and resolution as published by OWASP, SANS, etc.
• Experience with PCI or other regulated environments.
• Experience conducting threat models for complex, distributed products using standard threat modeling techniques and methodologies.
• Experience with standard authentication mechanisms, including SAML and OAuth2.
• Understanding of continuous integration / continuous deployment processes and tools.
• BS degree in related field or equivalent experience. MS degree in a related field or equivalent experience is a plus.

Location - Remote U.S.

Pay Grade - P
Equity Grade - 13

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include equity rewards, monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents.)

USA base pay range (CA, WA, NY, NJ, CT) per year: $225,000 - 275,000 USD

USA base pay range (all other U.S. states) per year: $200,000 - 250,000 USD

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest.

Affirm values information security as a critical part of the company’s continued success. Our mission is to make information security programmatic and cultural in Affirm, enabling the company to succeed in building honest financial products. The Security team posture increases security and reduces risk while securely enabling access to information for those who need it!

The Staff Product Security Engineer candidate will have experience building and architecting software as part of a larger team. The ideal candidate will work effectively with product and engineering teams to evaluate and influence product requirements, design, and implementation to improve the security of Affirm’s products.

What You'll Do

• Partner with Affirm product teams to ensure that security is included in every phase of the product development lifecycle.
• Conduct threat modeling and architecture reviews to ensure threats are understood, documented, and mitigated.
• Review and analyze product source code to identify security vulnerabilities and provide recommendations for secure implementation.
• Seek out opportunities to automate processes when appropriate.
• Identify emerging classes of vulnerabilities and developing solutions for them before they’re a problem.
• Assist product teams in the development of security focused test cases to enforce security requirements.
• Advise product teams on business security requirements early in the product development lifecycle.
• Decompose large, cross-team projects into individual tasks. Manage scope across teams and drive toward project closure.

What We Look For

• Deep understanding of web application architecture and design principles
• Experience using modern software development and delivery techniques to develop cloud-based services. Python, Kotlin, Java, AWS, and Azure experience preferred.
• Knowledge of common security flaws and resolution as published by OWASP, SANS, etc.
• Experience with PCI or other regulated environments.
• Experience conducting threat models for complex, distributed products using standard threat modeling techniques and methodologies.
• Experience with standard authentication mechanisms, including SAML and OAuth2.
• Understanding of continuous integration / continuous deployment processes and tools.
• BS degree in related field or equivalent experience. MS degree in a related field or equivalent experience is a plus.

Location - Remote Canada

Pay Grade - P
Equity Grade - 7

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).

Base pay range per year: $178,000 - 228,000 CAD