Remote Product Security Engineer II

Affirm; Houston (TX); On-site; USD 146,000 - 206,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is seeking an early-career Application Security Engineer to partner with product and engineering teams to assess risks, review code, and contribute lightweight tooling and automation that scale AppSec across Affirm.

You will read application code, support vulnerability management, and help translate findings into practical, secure-by-design guidance while balancing launch velocity and risk reduction.

Qualifications

• Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
• Experience with Git and GitHub workflows including branches, PRs, and code review.
• Hands-on experience building, testing, or securing software.
• Ability to write clear scripts or small programs to automate workflows.
• Understanding of common web, API, mobile, cloud security risks (OWASP Top 10).

Responsibilities

• Identify application security risks with product and engineering teams and frame them as business risks and next steps.
• Read application code, configurations, logs, and docs to understand system behavior and risk exposure.
• Contribute small code changes, scripts, detections, tests, or automatic safeguards.
• Review code changes in GitHub and track remediation work with engineers.
• Evaluate vulnerabilities from testing, bug bounties, tooling, or pentests and help prioritize remediation.
• Support vulnerability management workflows including triage, severity, remediation guidance, and reporting.
• Translate recurring findings into secure coding guidance, checklists, or reusable review patterns.
• Understand system designs, data flows, trust boundaries, and authentication/authorization models.
• Communicate security issues clearly to technical and non-technical audiences with risk context.
• Build relationships across teams to influence security outcomes without formal authority.
• Connect AppSec work to customer trust, regulatory expectations, and business outcomes.
• Continue developing offensive, defensive, and software engineering skills through labs, certifications, or internal programs.

Skills

Python

JavaScript/TypeScript

Code reading

Git/GitHub

Automation scripting

Security fundamentals

Threat modeling

Job description

Affirm is seeking an early-career Application Security Engineer to partner with product and engineering teams to assess risks, review code, and contribute lightweight tooling and automation that scale AppSec across Affirm.

You will read application code, support vulnerability management, and help translate findings into practical, secure-by-design guidance while balancing launch velocity and risk reduction.