Senior Product Security Engineer

Affirm

2h • $173,000 - $255,000 • Remote

About The Position

Affirm’s Security team works to make information security programmatic and cultural across the company, reducing risk while securely enabling access to information. The Senior Product Security Engineer partners with product and engineering teams to evaluate and influence product requirements, design, and implementation, helping improve the security of Affirm’s products throughout the product development lifecycle. The role includes threat modeling and architecture reviews, source-code security analysis, security testing guidance, and advising teams on business security requirements. It also involves identifying emerging vulnerabilities, automating processes, and coordinating cross-team security projects through completion.

The position is remote-first, with flexibility to work from almost anywhere within the country of employment. Some roles may occasionally require in-person work at an Affirm office, and new hires are invited to attend in-person onboarding.

Requirements

• Deep understanding of web application architecture and design principles.
• Experience building and architecting software as part of a larger team.
• Experience using modern software development and delivery techniques to develop cloud-based services.
• Knowledge of common security flaws and their resolution, such as those published by OWASP and SANS.
• Experience with PCI or other regulated environments.
• Experience conducting threat models for complex, distributed products using standard threat modeling techniques and methodologies.
• Experience with standard authentication mechanisms, including SAML and OAuth2.
• Understanding of continuous integration and continuous deployment processes and tools.
• Bachelor’s degree in a related field or equivalent experience.

Nice To Haves

• Experience with Python, Kotlin, Java, AWS, or Azure.
• Master’s degree in a related field or equivalent experience.

Responsibilities

• Partner with Affirm product teams to ensure security is included in every phase of the product development lifecycle.
• Conduct threat modeling and architecture reviews so threats are understood, documented, and mitigated.
• Review and analyze product source code to identify security vulnerabilities and recommend secure implementation approaches.
• Identify opportunities to automate processes when appropriate.
• Identify emerging classes of vulnerabilities and develop solutions proactively.
• Assist product teams in developing security-focused test cases that enforce security requirements.
• Advise product teams on business security requirements early in the product development lifecycle.
• Decompose large cross-team projects into individual tasks, manage scope across teams, and drive projects to closure.

Benefits

• 100% subsidized medical coverage for employees and their dependents.
• Dental and vision coverage for employees and their dependents.
• Monthly stipends for technology setup and health and wellness options.
• Flexible time off and generous holiday calendars.
• Employee stock purchase plan (ESPP) allowing employees to buy Affirm stock at a discount.
• Accommodations and support for candidates with disabilities during the interview process.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior