Remote Application Security Engineer II

Affirm; Boise (ID); On-site; USD 146,000 - 225,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is seeking an early-career Application Security Engineer in Boise to help assess risks, review code, and build lightweight tooling. You’ll collaborate with product, engineering, and risk teams to reduce security risk while delivering fast, reliable features.

You should enjoy reading code, have some security or software experience, and be eager to grow offensive, defensive, and automation skills in a remote-first company that values practical risk-based security.

Qualifications

• 0–2+ years of application security or related experience.
• Foundational programming ability in Python/JavaScript/Kotlin.
• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
• Experience using Git and GitHub or similar version-control workflows.
• Some hands-on experience building, testing, breaking, or securing software.

Responsibilities

• Partner with product and engineering teams to identify application security risks and frame them as business risks, launch options, and recommended next steps.
• Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist.
• Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows.
• Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers.
• Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; prioritize and remediate issues based on risk.
• Translate recurring security findings into secure coding guidance, checklists, and lightweight automation.
• Work with engineers to understand system designs, data flows, trust boundaries, authentication/authorization models, and potential abuse cases.
• Communicate security issues clearly to technical and non-technical audiences, including risk, tradeoffs, mitigations, and residual risk.
• Build relationships across affirm teams and influence security outcomes without formal authority.
• Connect AppSec work to customer trust, regulatory expectations, operational resilience, and business outcomes.
• Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, or certifications.

Skills

Python

JavaScript/TypeScript

GitHub

Secure coding

OWASP Top 10

Automation scripting

Code review

Tools

Burp Suite

Static/Dynamic Analysis

GitHub Actions

Job description

Affirm is seeking an early-career Application Security Engineer in Boise to help assess risks, review code, and build lightweight tooling. You’ll collaborate with product, engineering, and risk teams to reduce security risk while delivering fast, reliable features.

You should enjoy reading code, have some security or software experience, and be eager to grow offensive, defensive, and automation skills in a remote-first company that values practical risk-based security.