Senior CIAM Software Engineer

Role overview

What you’ll do

• Design and operate CIAM backend services and implement OAuth 2.0, OIDC, SAML, and SCIM standards.
• Develop Python and Kotlin APIs and integrate CIAM with internal data, messaging, fraud, and customer systems.
• Own MFA, step-up authentication, device binding, consent, and adaptive authentication flows.
• Automate infrastructure and deployments; monitor, debug, and optimize service performance, resilience, and abuse detection.

What we look for

• 5+ years of professional backend software engineering experience and strong production experience in Python or a similar language.
• Strong hands-on CIAM expertise and knowledge of OAuth 2.0, OIDC, SAML, and SCIM.
• Experience with APIs, automation frameworks, distributed systems, CI/CD, GitHub workflows, and cloud-native development.
• Experience integrating a CIAM platform such as Okta, Auth0, Ping Identity, ForgeRock, or Azure AD B2C using custom code, hooks, and APIs.
• Experience with Infrastructure as Code and automation tools such as Terraform; AWS is preferred.
• Security engineering fundamentals, including access control, token handling, encryption, MFA, and privacy by design.
• Clear communication and cross-functional collaboration; familiarity with AI-augmented development environments is noted.

Compensation

• Annual U.S. base pay range is $195,000–$255,000 in CA, WA, NY, NJ, and CT, and $173,000–$233,000 in other U.S. states.
• Total compensation may include equity, monthly stipends, and benefits.

Workplace

• Affirm describes itself as remote-first; most roles can be performed within the country of employment, with occasional in-person office work possible.
• New hires are invited to an in-person onboarding experience.

Benefits

• Benefits include medical, dental, and vision coverage, monthly spending stipends, flexible time off, holidays, and an employee stock purchase plan.