Remote AppSec Engineer II

Affirm; Minneapolis (MN); On-site; USD 146,000 - 225,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is a remote-first company reinventing credit with a focus on transparent, consumer-friendly products. We seek an early-career Application Security Engineer who collaborates with product and engineering to assess risks and develop tooling to scale AppSec efforts.

You’ll read code, review PRs, and contribute lightweight automation while partnering across teams to prioritize remediation and improve secure design decisions. This role supports ongoing learning and practical security work.

Qualifications

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, or equivalent practical experience.
• Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
• Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking.
• Some hands-on experience building, testing, breaking, or securing software.
• Ability to write clear, maintainable scripts or small programs to solve practical problems.
• Foundational understanding of common web, API, mobile, cloud, and application security risks.
• Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite.
• Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization.
• Ability to reason about risk and tradeoffs, not just identify issues.
• Strong product and engineering empathy.
• Clear written and verbal communication skills.
• A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams.
• Curiosity, humility, and a growth mindset.

Responsibilities

• Partner with product and engineering teams to identify application security risks and frame them as business risks, launch options, and steps.
• Read application code, configuration, pull requests, logs, and docs to understand systems and risks.
• Contribute small code changes, scripts, detections, tests, or automation to improve AppSec workflows.
• Work in GitHub to review code changes, discuss engineering context, track remediation work, and collaborate with engineers.
• Evaluate vulnerabilities from internal testing, bug bounty reports, tooling, penetration tests, and prioritize remediation based on risk.
• Contribute to vulnerability management workflows, including triage, severity assessment, remediation guidance, tracking, and reporting.
• Translate recurring findings into secure coding guidance, checklists, and lightweight automation.
• Understand system designs, data flows, trust boundaries, and auth models with engineers.
• Communicate security issues clearly to technical and non-technical audiences.

Skills

Python

JavaScript/TypeScript

Code reading & debugging

Security basics

Problem solving

Tools

GitHub

Burp Suite

Job description

Affirm is a remote-first company reinventing credit with a focus on transparent, consumer-friendly products. We seek an early-career Application Security Engineer who collaborates with product and engineering to assess risks and develop tooling to scale AppSec efforts.

You’ll read code, review PRs, and contribute lightweight automation while partnering across teams to prioritize remediation and improve secure design decisions. This role supports ongoing learning and practical security work.