Remote Product Security Engineer II

Affirm; Las Vegas (NV); Remote; USD 146,000 - 206,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is seeking an early-career Application Security Engineer to help assess risks, support vulnerability management, and contribute lightweight tooling to scale security across Affirm. You will work with product and engineering teams to identify risks, review code and configurations, and participate in remediation decisions.

This role emphasizes hands-on coding, security tooling, and practical risk reduction in a remote-first environment where most roles are flexible to work from anywhere in

Qualifications

• 0–2+ years of experience in application security or related fields.
• Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading and reasoning about code across unfamiliar codebases.
• Experience with Git/GitHub workflows and PR review.

Responsibilities

• Identify application security risks with product and engineering teams and frame them as business risks.
• Read code, configurations, pull requests, logs, and docs to locate security issues.
• Contribute small code changes, scripts, or automation to improve AppSec workflows.
• Review code in GitHub, track remediation work, and collaborate with engineers.
• Evaluate vulnerabilities from internal testing, bug bounty reports, and security tooling.

Skills

Python

JavaScript/TypeScript

Git/GitHub

Vulnerability management

OWASP Top 10

Code reading

Tools

Burp Suite

Job description

Affirm is seeking an early-career Application Security Engineer to help assess risks, support vulnerability management, and contribute lightweight tooling to scale security across Affirm. You will work with product and engineering teams to identify risks, review code and configurations, and participate in remediation decisions.

This role emphasizes hands-on coding, security tooling, and practical risk reduction in a remote-first environment where most roles are flexible to work from anywhere in