Remote Product Security Engineer (AppSec)

Affirm; Nashville (TN); On-site; USD 146,000 - 206,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is seeking an early-career Application Security Engineer to help assess risks, support vulnerability management, and collaborate with product and engineering to secure designs. You will read code, contribute automated checks, and help drive secure development practices in a remote-first environment.

You will work across teams to triage findings, document mitigations, and build lightweight tooling to scale security across Affirm.

Qualifications

• 0–2+ years of experience in application security, software engineering, security engineering, or vulnerability management.
• Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin.
• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
• Experience using Git and GitHub or similar version-control workflows.

Responsibilities

• Identify application security risks with product and engineering teams and frame them as business risks with next steps.
• Read application code, configuration, logs, and docs to understand systems and risks.
• Contribute small code changes or automation to improve AppSec workflows and reduce recurring issues.
• Review code changes in GitHub and collaborate with engineers on remediation efforts.
• Evaluate vulnerabilities from testing, bug bounties, and tooling; prioritize and remediate based on risk.

Skills

Python

JavaScript/TypeScript

Kotlin

Git/GitHub

Offensive security basics

Security tooling

Tools

Burp Suite

Job description

Affirm is seeking an early-career Application Security Engineer to help assess risks, support vulnerability management, and collaborate with product and engineering to secure designs. You will read code, contribute automated checks, and help drive secure development practices in a remote-first environment.

You will work across teams to triage findings, document mitigations, and build lightweight tooling to scale security across Affirm.