Remote Junior Application Security Engineer

Affirm; Cleveland (OH); On-site; USD 146,000 - 206,000; Full time

Benefits offered by this job

Health care coverage for you and your 

Employee stock purchase plan (ESPP)

Generous time off

Job summary

Affirm is seeking an early-career Application Security Engineer to help assess risks, support vulnerability management, and partner with engineering on secure design decisions. You will contribute lightweight tooling, automation, and code-informed analysis to scale AppSec across Affirm.

The role emphasizes reading code, reviewing pull requests, and collaborating across product, engineering, and risk teams in a remote-first environment.

Qualifications

• 0–2+ years of experience in application security or related fields.
• Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
• Experience using Git and GitHub or similar workflows.
• Hands-on experience building, testing, breaking, or securing software.
• Ability to write clear scripts or small programs to automate tasks.
• Foundational understanding of OWASP Top 10 and related risks.
• Interest in offensive security and certifications.
• Ability to reason about risk and tradeoffs and communicate impacts clearly.
• Strong product and engineering empathy and collaboration.

Responsibilities

• Identify application security risks with product and engineering teams and frame them as business risks and next steps.
• Read application code, configs, PRs, logs, and docs to understand system behavior and risks.
• Contribute small code changes, scripts, detections, and automation to improve workflows.
• Review code changes in GitHub and track remediation with engineers.
• Evaluate vulnerabilities from internal tests, bug bounties, tooling, and pen tests; help prioritize remediation.
• Contribute to vulnerability management workflows including triage and reporting.
• Develop secure coding guidance, checklists, and reusable patterns from recurring findings.
• Understand system designs, data flows, and trust boundaries with engineers.
• Communicate risks and mitigations clearly to technical and non-technical audiences.

Skills

Python

JavaScript/TypeScript

Security engineering

Vulnerability management

Code review

Communication

Education

Bachelor's degree in CS or related field

Tools

GitHub

Burp Suite

Threat modeling

Job description

Affirm is seeking an early-career Application Security Engineer to help assess risks, support vulnerability management, and partner with engineering on secure design decisions. You will contribute lightweight tooling, automation, and code-informed analysis to scale AppSec across Affirm.

The role emphasizes reading code, reviewing pull requests, and collaborating across product, engineering, and risk teams in a remote-first environment.