Product Security Engineer II – Remote & Code-Focused

Socket.dev; United States; On-site; USD 146,000 - 206,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off and holidays

ESPP

Job summary

Affirm seeks an early-career Application Security Engineer to assess risks, support vulnerability management, and partner with engineering on secure design. You will contribute lightweight tooling and code-informed analysis to scale AppSec across the company.

You will work with product, engineering, risk, and compliance teams to balance launch velocity with meaningful risk reduction and help drive customer trust through secure-by-design decisions.

Qualifications

• Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading, navigating, and reasoning about code.

Responsibilities

• Identify application security risks and frame them as business risks with next steps.
• Read code, configs, PRs, logs, and docs to understand systems and risks.
• Contribute small code changes, scripts, or automation to improve AppSec workflows.
• Review code changes in GitHub and track remediation work with engineers.
• Evaluate vulnerabilities from internal tests, bug bounty, tooling, and pentests; prioritize remediation.
• Contribute to vulnerability management workflows: triage, severity, remediation guidance.

Skills

Python

JavaScript/TypeScript

Kotlin

Git / GitHub

Code reading & analysis

Communication

Tools

GitHub

Burp Suite

Job description

Affirm seeks an early-career Application Security Engineer to assess risks, support vulnerability management, and partner with engineering on secure design. You will contribute lightweight tooling and code-informed analysis to scale AppSec across the company.

You will work with product, engineering, risk, and compliance teams to balance launch velocity with meaningful risk reduction and help drive customer trust through secure-by-design decisions.