Staff CIAM Software Engineer (CIAM)

Location: Remote Canada; remote-first with most roles available almost anywhere within the country of employment. Occasional in-person work at an Affirm office may be required, and all new hires are invited to attend in-person onboarding.

Base pay: $181,000–$241,000 per year in Canada. Total compensation may also include equity rewards, monthly health, wellness, and technology stipends, and benefits.

Company

Affirm provides a predictable way for customers to pay over time and is building customer identity and authentication capabilities for B2C and B2B experiences.

What you will do

• Design, build, and operate CIAM backend services for customer registration, authentication, authorization, account lifecycle, and profile management.
• Implement OAuth 2.0, OIDC, SAML, and SCIM standards in scalable, correctly integrated services.
• Develop Python and Kotlin APIs and backend services for web, mobile, and partner applications.
• Integrate CIAM platforms with user data stores, messaging, fraud signals, and downstream customer platforms.
• Own secure authentication and account flows, including MFA, step-up authentication, device binding, consent, and adaptive authentication.
• Automate infrastructure and deployments, and monitor, debug, and optimize CIAM services for performance, resilience, and abuse detection.

Requirements

• 7+ years of experience designing, developing, and launching backend systems at scale, or 5+ years of professional backend software engineering experience.
• Strong experience designing and implementing CIAM systems, with hands-on knowledge of OAuth 2.0, OIDC, SAML, and SCIM beyond basic configuration.
• Strong production experience in Python or a similar backend language; experience with Python or Kotlin is required for backend development.
• Experience designing APIs, automation frameworks, and distributed systems, including data modeling, latency, error handling, and observability.
• Extensive experience developing highly available distributed systems with technologies such as AWS, MySQL, Spark, and Kubernetes.
• Hands-on experience building and maintaining CI/CD pipelines, GitHub-based development workflows, and Buildkite or similar build systems.
• Experience with cloud-native development, preferably AWS, and Infrastructure as Code and automation tools such as Terraform.
• Hands-on experience extending and integrating CIAM platforms such as Okta, Auth0, Ping Identity, ForgeRock, or Azure AD B2C using custom code, hooks, and APIs.
• Strong security fundamentals covering access control models, token handling, encryption, MFA, and privacy by design; clear communication and collaboration with product, frontend, mobile, and security teams.
• Familiarity with Cursor and other AI-augmented development environments.

Culture & Benefits

• Remote-first work with flexibility within Canada and occasional in-person office or onboarding events.
• 100% subsidized medical coverage for employees and dependents, plus dental and vision coverage.
• Monthly stipends for technology, health, and wellness spending.
• Flexible time off and generous holiday calendars.
• Employee stock purchase plan with discounted Affirm stock.
• Inclusive interview process with accommodations available for candidates with disabilities.

Hiring process

• The posting is for an existing vacancy.
• Interview accommodations are available for candidates with disabilities.