Specialty
The role
Affirm's InfoSec team is hiring a Staff Security Engineer to run security reviews of enterprise AI and LLM systems, including agentic and MCP-based tools. The role threat-models these systems and builds guardrails. The remote role is open only to residents of listed Canadian provinces.
What you will do
- Lead and improve the security review process for internal AI tools, agentic systems and AI features
- Threat-model LLM systems for prompt injection, excessive agency, tool-permission abuse and data exposure
- Review source code, system prompts, agent configurations and MCP definitions
- Build guardrails and policy-as-code for AI systems, including authn/authz for agentic tools
- Review AI features of third-party SaaS vendors
- Write AI incident response playbooks and lead cross-functional AI security work
What they ask for
- Seasoned security engineer with hands-on security architecture for AI/LLM systems
- Experience threat modeling against the OWASP Top 10 for LLM Applications
- Knowledge of MCP servers, tool-permission models and agent-to-tool trust boundaries
- Python or similar for security tooling, and Terraform or similar for policy-as-code
- Familiarity with Kubernetes, AWS, OAuth2, SAML and non-human identities
- Experience building AI governance artifacts and leading cross-functional initiatives
- Residence in a listed Canadian province (Alberta, BC, Manitoba, NB, NL, NS, Ontario, PEI, Saskatchewan)
What they offer
- 100% subsidized medical, dental and vision coverage
- Possible monthly stipends for health, wellness and tech spending
- Possible equity rewards from Affirm Holdings
This is our own short reading of the posting. The full description, and anything that has changed since, is on Affirm's careers page behind the apply button.
