About this role
Affirm needs a specialist to establish robust guardrails and security reviews so the business can adopt enterprise artificial intelligence systems safely. The InfoSec team protects company data and systems from emerging threats by enforcing protective controls, managing risk, and handling incidents.
In this remote position based in Canada, the engineer will build and operate the end-to-end security review process for large language models and agentic tools. Responsibilities include evaluating architecture, threat modeling data flows, designing security tooling using Python and infrastructure-as-code, and assessing third-party SaaS vendors. Candidates who thrive in this environment possess deep expertise in AI security architecture and enjoy collaborating across legal, privacy, and engineering departments.
What you will do
- Lead and continuously improve the enterprise AI security review process by evaluating architecture, data flows, and permissions of internal AI tools and agentic systems.
- Perform threat modeling on LLM-based systems and data flows to identify risks like prompt injection, excessive agency, and data exposure.
- Review source code, system prompts, agent configurations, and tool manifests while helping tool owners build security test cases.
- Design and build security guardrails, permission boundaries, and automated policy-as-code tooling using Python and infrastructure-as-code.
- Evaluate the artificial intelligence capabilities of third-party SaaS vendors during security reviews to drive risk-based adoption decisions.
- Identify emerging agentic security vulnerabilities and contribute to specialized incident response playbooks as a senior escalation point.
- Drive cross-functional AI security initiatives to closure while advising technical and executive stakeholders.
What you need
- Bring hands-on experience designing, evaluating, and maintaining security architecture for artificial intelligence and LLM-based systems.
- Demonstrate practical background in threat modeling applications against frameworks like the OWASP Top 10 for LLM Applications.
- Possess familiarity with enterprise tools for AI visibility and control such as CASB and Identity Providers like Okta.
- Write security tooling and guardrails using Python or similar languages alongside infrastructure-as-code deployment tools.
- Understand how LLMs and agentic systems are built including RAG, embeddings, and tool use alongside authentication models like OAuth2 and SAML.
- Communicate effectively with technical and executive audiences while leading cross-functional initiatives.
Nice to have
- Experience in regulated environments such as SOC 2 and PCI DSS
- Applying identity and access management to non-human and agent identities
Benefits
- 100% subsidized medical coverage, dental, and vision for employees and dependents
- Monthly stipends supporting tech setup, health, and wellness options
- Flexible time off and generous holiday calendars
- Employee stock purchase plan to buy company stock at a discount
Skills and tech stack
Questions candidates ask
What is the remote work policy for this role?
This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan. Affirm is a remote-first company where most roles can be done from almost anywhere within the country of employment.
What is the salary range for this position?
The Canadian base pay range per year is $173,000 to $233,000 with a base pay grade of P and equity grade of 7. Employees new to the company typically come in at the start of the pay range.
What kind of benefits and total compensation are included?
Base pay is part of a total package that may include monthly stipends for health, wellness, and tech spending. Additional benefits include 100% subsidized medical coverage, dental and vision for you and dependents, flexible time off, and equity rewards.