About this role
Security professionals who enjoy diving deep into AI architecture and collaborating across multiple departments will find this position engaging. The InfoSec team at Affirm protects systems and data from evolving threats by managing security risk, monitoring vulnerabilities, and enforcing protective controls across the organization.
In this role, the engineer builds and runs the end-to-end security review process for enterprise AI and LLM systems. Responsibilities include evaluating architecture, prioritizing risks, and designing controls that allow the business to adopt artificial intelligence safely. The person in this position partners closely with Security, Legal, Privacy, Compliance, IT, and Engineering to make these processes scalable and repeatable.
What you will do
- Lead and continuously improve the enterprise AI security review process by evaluating architecture, data flows, permissions, and design of internal AI tools and agentic systems.
- Perform threat modeling on AI and LLM systems to identify risks such as prompt injection, excessive agency, data poisoning, and sensitive data exposure.
- Review source code, system prompts, agent configurations, and permission manifests to help tool owners build security-focused test cases.
- Design and build security guardrails and tooling for authentication, authorization, data handling, and policy-as-code.
- Evaluate the artificial intelligence capabilities of third-party software vendors as part of routine vendor and SaaS security reviews.
- Identify emerging classes of security vulnerabilities, develop mitigations, and contribute to specialized incident response playbooks.
- Lead cross-functional initiatives to closure while advising technical and executive stakeholders as an internal point of expertise.
What you need
- Bring hands-on experience designing, evaluating, and maintaining security architecture for AI and LLM-based systems.
- Demonstrate deep expertise in enterprise security systems, processes, controls, and application threat modeling.
- Possess practical experience reviewing applications against frameworks like the OWASP Top 10 for LLM Applications.
- Show familiarity with corporate systems where artificial intelligence is adopted, including OpenAI, Anthropic, GitHub, and Google Workspace.
- Build security tooling and guardrails using Python, Infrastructure as Code, Kubernetes, and AWS.
- Understand how large language models, retrieval-augmented generation, embeddings, and fine-tuning are constructed.
Nice to have
- Experience in regulated environments such as SOC 2 and PCI DSS
- Applying identity and access management to non-human and agent identities
Benefits
- Health coverage at no cost covering 100% of premiums for employees and dependents
- Monthly spending stipends for tech setup, health, and wellness options
- Flexible time off and generous holiday calendars
- Employee stock purchase plan to buy company stock at a discount
Skills and tech stack
Questions candidates ask
What is the remote work policy for this role?
Affirm is a remote-first company where most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an office, and all new hires are invited to attend an in-person onboarding experience.
What is the salary range for this position?
The USA base pay range for California, Washington, New York, New Jersey, and Connecticut is $220,000 to $280,000 per year. For all other U.S. states, the base pay range is $195,000 to $255,000 per year.
What kind of tech stack and tools will I work with?
You will build security tooling, guardrails, and detections using Python or similar languages, and deploy cloud services and policy-as-code using Infrastructure as Code tools like Terraform. The role also involves working with corporate systems such as OpenAI, Anthropic, GitHub, Google Workspace, Slack, Notion, and Jira.