Remote Product Security Engineer II

Affirm; Chicago (IL); Remote; USD 146,000 - 206,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is seeking an early-career Application Security Engineer who enjoys reading and reasoning about code and contributing lightweight tooling to scale AppSec across the company.

You will partner with product and engineering teams to identify security risks, review code and configurations, and help prioritize remediation based on real-world risk. Remote-first with strong focus on collaboration and security outcomes.

Qualifications

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.

Responsibilities

• Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps.
• Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist.
• Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues.
• Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers.
• Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk.
• Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting.
• Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation.
• Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases.
• Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk.
• Build strong relationships across affirm teams and influence security outcomes without relying on formal authority.
• Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes.
• Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs.

Skills

Python

JavaScript/TypeScript

Kotlin

Git

GitHub

Offensive security

Secure coding

Automation scripting

Code review

Tools

Burp Suite

Job description

Affirm is seeking an early-career Application Security Engineer who enjoys reading and reasoning about code and contributing lightweight tooling to scale AppSec across the company.

You will partner with product and engineering teams to identify security risks, review code and configurations, and help prioritize remediation based on real-world risk. Remote-first with strong focus on collaboration and security outcomes.