Remote Product Security Engineer II (Canada)

Far Coder; Canada; Hybrid; CAD 133,000 - 183,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is hiring a remote Product Security Engineer II based in Canada. The role focuses on identifying and mitigating application security risks, collaborating with product and engineering, and contributing tooling to scale AppSec efforts.

Strong coding skills in Python, JavaScript/TypeScript, and Kotlin are valued, with comfort reading unfamiliar codebases. The position requires 4+ years in relevant security or engineering roles, hands-on experience with security tooling, and a pragmatic,

Qualifications

• 4+ years of experience in application security, software engineering, security engineering, vulnerability management, or equivalent practical experience.
• Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
• Experience using Git and GitHub or similar version-control workflows.

Responsibilities

• Partner with product and engineering teams to identify application security risks and frame them as business risks.
• Read application code, configuration, logs, and documentation to understand systems and identify risks.
• Contribute lightweight tooling, scripts, detections, tests, or automation to improve AppSec workflows.
• Review code changes in GitHub, understand engineering context, and track remediation with engineers.
• Evaluate vulnerabilities from testing, bug reports, and security tooling; prioritize and remediate based on risk.
• Translate recurring findings into reusable security guidance, checklists, or automation.

Skills

4+ years AppSec experience

Python

JavaScript/TypeScript

Kotlin

Git & GitHub

Code reading

Risk-based thinking

Tools

Burp Suite

Job description

Affirm is hiring a remote Product Security Engineer II based in Canada. The role focuses on identifying and mitigating application security risks, collaborating with product and engineering, and contributing tooling to scale AppSec efforts.

Strong coding skills in Python, JavaScript/TypeScript, and Kotlin are valued, with comfort reading unfamiliar codebases. The position requires 4+ years in relevant security or engineering roles, hands-on experience with security tooling, and a pragmatic,