Staff CIAM Security Engineer

RemoteLeadPosted Aug 17, 2026

PythonKotlinOAuthOIDCSAMLSCIMAWSKubernetes+18 more

About this role

Affirm is building the next generation of customer identity and authentication. This hands-on engineering role inside Information Security focuses on designing and shipping core CIAM capabilities that protect customers and support growth across B2C and B2B experiences.

Must have

7+ years designing, developing and launching backend systems at scale

5+ years professional backend software engineering experience

Strong production experience in Python or similar backend language

Deep hands-on knowledge of OAuth 2.0, OIDC, SAML, and SCIM beyond basic configuration

Experience designing APIs, automation frameworks, and distributed systems

Hands-on experience building and maintaining CI/CD pipelines

Experience with GitHub-based development workflows and Buildkite or similar

Cloud-native development experience, preferably AWS

Experience extending and integrating CIAM platforms such as Okta, Auth0, Ping Identity, ForgeRock, or Azure AD B2C

Solid understanding of backend and distributed systems fundamentals

Experience with Infrastructure as Code and automation tools such as Terraform

Strong security fundamentals including access control, token handling, encryption, MFA, and privacy by design

Familiarity with AI-augmented development environments such as Cursor

Technologies

PythonAWSSparkKotlinGitDockerRESTLinuxMySQLTerraformJSONGitHubOAuthKubernetesCI/CDSAMLOIDCSCIMAuth0Azure AD B2CPing IdentityForgeRockBuildkiteMFACursorOkta

Responsibilities

Design, build, and operate core CIAM backend services for customer registration, authentication, authorization, and account lifecycle

Implement and extend identity standards such as OAuth 2.0, OIDC, SAML, and SCIM in code

Develop backend APIs and services in Python and Kotlin for web, mobile, and partner applications

Integrate CIAM platforms with internal systems including user data stores, messaging, fraud signals, and downstream platforms

Own secure authentication and account flows end to end including MFA, step-up authentication, device binding, consent, and adaptive authentication

Automate CIAM infrastructure and deployments using Infrastructure as Code and CI/CD pipelines

Monitor, debug, and optimize CIAM services for performance, resilience, and abuse detection

Benefits

Health insuranceDental insuranceVision insuranceRemote workFlexible work arrangementsFlexible Spending WalletsCompetitive vacation and holiday schedulesESPP

Amenities

100% subsidized medical coverage for you and dependentsMonthly stipends for health, wellness and tech spendingFlexible Spending Wallets for Technology, Food, Lifestyle, and family forming expensesCompetitive vacation and holiday schedulesESPP enabling share purchase at discount