Senior Product Security Engineer

• The Senior Product Security Engineer candidate will have experience building and architecting software as part of a larger team. The ideal candidate will work effectively with product and engineering teams to evaluate and influence product requirements, design, and implementation to improve the security of Affirms products
• Partner with Affirms product teams to ensure that security is included in every phase of the product development lifecycle
• Conduct threat modeling and architecture reviews to ensure threats are understood, documented, and mitigated
• Review and analyze product source code to identify security vulnerabilities and provide recommendations for secure implementation
• Seek out opportunities to automate processes when appropriate
• Identify emerging classes of vulnerabilities and developing solutions for them before they’re a problem
• Assist product teams in the development of security focused test cases to enforce security requirements
• Advise product teams on business security requirements early in the product development lifecycle
• Decompose large, cross-team projects into individual tasks. Manage scope across teams and drive toward project closure

• Compensation:
  We have a simple, flexible, and transparent remote-first compensation structure so you can make the best decisions for yourself and your family
• Spending Wallets:
  Access tech, food, lifestyle, and family planning wallets for your expenses
• Supportive Communities:
  Get involved with our employee resource groups and community groups
• Remote-first Workforce:
  If your role is remote, you can set up shop anywhere in your home country
• Generous Time Off:
  Take the time you need when life happens
• Health Benefits:
  
  Get a plan that fits your needs
• Mental Healthcare:
  Take care of your mind with great mental health programs
• Parental Leave:
  Birth and non-birth parents get 18 weeks’ paid leave. Plus, a 4-week return-to-work transition program, at full base pay
• Away Days:
  We offer 20 company-wide paid days off—which help our teams collectively pause to recharge
• Learning & Development:
  Engage in exciting learning programs to level up your growth

Deep understanding of web application architecture and design principles BS degree in related field or equivalent experience

Understanding of continuous integration / continuous deployment processes and tools

Experience conducting threat models for complex, distributed products using standard threat modeling techniques and methodologies

Experience with PCI or other regulated environments MS degree in a related field or equivalent experience is a plus

Experience with Python, Kotlin, Java, AWS, and Azure is preferred

Knowledge of common security flaws and resolution as published by OWASP, SANS, etc

Experience with standard authentication mechanisms, including SAML and OAuth2

Experience using modern software development and delivery techniques to develop cloud-based services