Remote Product Security Engineer II — Build Secure Apps

Affirm; Sioux Falls (SD); Remote; USD 146,000 - 225,000; Full time

Benefits offered by this job

Remote-first company

Health coverage for you and dependents

Flexible Spending Wallets

Time off and leave

ESPP

Job summary

Affirm is seeking an early-career Application Security Engineer to help assess application risks, support vulnerability management, and collaborate with engineering teams to design secure systems.

You will read code, contribute lightweight tooling, review pull requests in GitHub, and translate findings into practical guidance while growing hands-on security and software engineering skills through practical work and learning opportunities.

Qualifications

• 0–2+ years of experience in application security or related fields.
• Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading, navigating, and reasoning about code.
• Experience using Git and GitHub workflows (branches, PRs, code review).
• Hands-on experience building, testing, or securing software.
• Ability to write scripts or small programs to automate tasks.
• Understanding of common web, API, mobile, cloud security risks (OWASPTop10).
• Interest in offensive security and security certifications.
• Exposure to vulnerability management concepts (triage, remediation, risk-based prioritization).
• Ability to reason about risk and tradeoffs to inform mitigations.
• Strong product/engineering empathy and clear communication.
• Collaborative mindset across product, engineering, compliance, risk, and security teams.
• Growth mindset and secure-by-design judgment.

Responsibilities

• Partner with product and engineering teams to identify application security risks and frame them as business risks and next steps.
• Read application code, configuration, PRs, logs, and docs to spot security risks.
• Contribute small code changes, scripts, detections, tests, or automation that improve AppSec workflows.
• Review code changes in GitHub and track remediation work with engineers.
• Evaluate vulnerabilities from internal testing, bug bounties, tooling, or pen tests and prioritize fixes.
• Contribute to vulnerability management workflows: triage, severity assessment, remediation guidance and reporting.
• Translate recurring findings into secure coding guidance, checklists, or reusable patterns.
• Communicate security issues clearly to technical and non-technical audiences.

Skills

Python

JavaScript/TypeScript

Kotlin

Git & GitHub

Tools

Burp Suite

Job description

Affirm is seeking an early-career Application Security Engineer to help assess application risks, support vulnerability management, and collaborate with engineering teams to design secure systems.

You will read code, contribute lightweight tooling, review pull requests in GitHub, and translate findings into practical guidance while growing hands-on security and software engineering skills through practical work and learning opportunities.