Staff CIAM Software Engineer

About Affirm and the Role

Affirm empowers consumers with transparent and flexible payment options, prioritizing clarity and fairness without hidden fees. We are developing the next generation of Customer Identity and Access Management (CIAM) solutions to safeguard users and support scalable growth. This role, situated within Information Security, is hands-on, focusing on the design and deployment of critical CIAM backend services.

Key Responsibilities

• Develop and maintain backend services that manage registration, authentication, authorization, account lifecycle, and profile management for both business-to-consumer (B2C) and business-to-business (B2B) platforms.
• Implement and extend identity standards such as OAuth 2.0, OpenID Connect (OIDC), SAML, and SCIM, ensuring scalable, secure, and clean integrations.
• Create backend APIs and services using Python and Kotlin to expose identity functionality for web, mobile, and partner applications.
• Integrate CIAM systems with internal resources including user data stores, messaging queues, fraud detection tools, and downstream customer platforms.
• Manage secure authentication workflows end-to-end, incorporating multi-factor authentication (MFA), step-up authentication, device binding, consent management, and adaptive authentication logic.
• Automate infrastructure provisioning and deployments through Infrastructure as Code and continuous integration/continuous deployment (CI/CD) pipelines treating CIAM as a foundational platform service.
• Monitor, troubleshoot, and optimize CIAM systems for performance, fault tolerance, and abuse detection in high-scale environments.

Required Qualifications

• At least 7 years of experience building, designing, and delivering scalable backend systems using languages like Python or Kotlin.
• Extensive proficiency in developing highly available distributed systems using cloud platforms such as AWS, relational databases like MySQL, big data tools including Spark, and container orchestration via Kubernetes.
• A proven record of leading feature delivery, system component development, or decommissioning of legacy functionalities with clear technical plans and high-quality, maintainable code.
• Deep hands-on expertise with CIAM platforms and standards, implementing OAuth 2.0, OIDC, SAML, SCIM beyond basic configurations.
• Experience with CI/CD pipelines and automation tools, using GitHub workflows and build systems like Buildkite or similar.
• Strong knowledge of security principles including access control models, token management, encryption, multi-factor authentication, and embedding privacy by design in software engineering.
• Experience building custom extensions and integrations with CIAM solutions such as Okta, Auth0, Ping Identity, ForgeRock, or Azure AD B2C.
• Mastery in backend design fundamentals such as API architecture, data modeling, latency management, error handling, and observability metrics.
• Familiarity with Infrastructure as Code tools like Terraform.
• Effective communication skills for collaboration across product, frontend, mobile, and security teams while leading backend identity services.
• Experience or familiarity with AI-assisted development tools like Cursor is a plus.

Compensation and Benefits

• Base annual salary range: $181,000 to $241,000, adjusted by location, experience, and skills.
• Equity participation under the USA Grade 7 level.
• Remote-first work environment with an in-person onboarding experience; some roles may occasionally require in-office presence.
• Comprehensive benefits package including 100% employer-covered medical insurance for employees and dependents, dental and vision coverage.
• Monthly stipends to support technology and wellness choices.
• Flexible paid time off and generous holidays to promote employee well-being.
• Employee Stock Purchase Plan (ESPP) enabling discounted acquisition of company shares.

Additional Information

Affirm strives to provide an inclusive interview experience and accommodates candidates with disabilities. Applicants from San Francisco or Los Angeles benefit from Affirm's compliance with laws concerning consideration of arrest and conviction records. Candidates acknowledge reading Affirm's Global Candidate Privacy Notice before applying.