Affirm

Security Engineer

• Lead and continuously improve Affirm’s enterprise AI security review process
• Evaluate architectures, data flows, permissions, and designs of internal AI tools, agentic/MCP-based systems, and AI features
• Embed security requirements into the design phase
• Threat model AI/LLM systems and data flows for prompt injection, insecure output handling, excessive agency, tool-permission abuse, data poisoning, and sensitive-data exposure
• Drive remediation of identified risks
• Review source code, system prompts, agent configurations, and tool/permission manifests
• Help tool owners develop security-focused test cases and red-team/evaluation scenarios
• Design and build security guardrails and tooling for AI systems, permission boundaries, authentication/authorization, data handling, logging/monitoring, and policy-as-code
• Evaluate third-party SaaS AI capabilities during vendor and SaaS security reviews
• Identify emerging AI/agentic security vulnerabilities and develop mitigations
• Contribute to AI-specific incident response playbooks as a senior escalation point
• Lead cross-functional AI security initiatives to closure
• Advise technical and executive stakeholders as an internal point of expertise
• Monitor the AI security landscape, including OWASP LLM Top 10 and MITRE ATLAS, and translate research into practical controls

Staff Product Security Engineer

• Build and run Affirm's end-to-end security review process for enterprise AI/LLM systems
• Evaluate architecture, data flows, permissions, and design of internal AI tools, agentic/MCP-based systems, and AI features
• Embed security requirements into the AI system design phase
• Threat model AI/LLM systems and data flows for prompt injection, insecure output handling, excessive agency, tool-permission abuse, data poisoning, and sensitive-data exposure
• Drive remediation of identified risks
• Review source code, system prompts, agent configurations, and tool/permission manifests such as MCP definitions
• Help tool owners create security-focused test cases and red-team/evaluation scenarios
• Design and build AI security guardrails and tooling for permission boundaries, authentication/authorization, data handling, logging/monitoring, and policy-as-code
• Evaluate third-party SaaS AI capabilities during vendor and SaaS security reviews
• Drive risk-based AI adoption decisions
• Identify emerging AI/agentic security vulnerabilities and develop mitigations
• Contribute to AI-specific incident response playbooks as a senior escalation point
• Lead cross-functional AI security initiatives across Security, Legal, Privacy, Compliance, IT, and Engineering
• Advise technical and executive stakeholders as an internal subject-matter expert
• Monitor the AI security landscape, including OWASP LLM Top 10 and MITRE ATLAS, and translate research into practical controls