Product Security Engineer II | Remote & Impactful AppSec

Affirm; Washington (District of Columbia); On-site; USD 146,000 - 225,000; Full time

Benefits offered by this job

Health care coverage for you and your+

Job summary

Affirm is hiring an early-career Application Security Engineer who enjoys working with code and collaborating across product, engineering, and risk teams. You’ll assess risks, support vulnerability management, and contribute lightweight tooling to scale AppSec across Affirm.

You will read code, review changes in GitHub, and help translate findings into practical mitigations while growing offensive and defensive security skills in a product-driven environment.

Qualifications

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, or equivalent.
• Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading and reasoning about code and unfamiliar codebases.
• Experience with Git and GitHub workflows (branches, PRs, code review).
• Hands-on experience building, testing, or securing software.

Responsibilities

• Partner with product and engineering teams to identify application security risks and frame them as business risks with next steps.
• Read application code, configuration, logs, and docs to understand system behavior and risk points.
• Contribute small code changes, scripts, detections, or automation to improve AppSec workflows.
• Review code in GitHub, discuss context, track remediation work with engineers.
• Evaluate vulnerabilities from internal tests, bug bounties, tooling, or pentests and prioritize remediation.
• Contribute to vulnerability management workflows including triage and remediation guidance.
• Translate recurring findings into secure coding guidance, checklists, or reusable patterns.
• Understand system designs, data flows, trust boundaries, and auth models with engineers.
• Communicate security issues clearly to technical and non-technical audiences.
• Build relationships across affirm teams to influence security outcomes.
• Connect AppSec work to customer trust, regulatory expectations, and business outcomes.
• Develop hands-on offensive/defensive/engineering skills through work, labs, or certifications.

Skills

Python

JavaScript/TypeScript

Kotlin

Git & GitHub

Code reading & debugging

Offensive security interest

Job description

Affirm is hiring an early-career Application Security Engineer who enjoys working with code and collaborating across product, engineering, and risk teams. You’ll assess risks, support vulnerability management, and contribute lightweight tooling to scale AppSec across Affirm.

You will read code, review changes in GitHub, and help translate findings into practical mitigations while growing offensive and defensive security skills in a product-driven environment.