Remote Product Security Engineer II - Build Trust & Security

Affirm; Baltimore (MD); On-site; USD 146,000 - 206,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Paid time off

Employee stock purchase plan

Job summary

Affirm invites an early-career Application Security Engineer to join our remote-first team focused on building trust and secure products. You will analyze code, configurations, and deployments to surface risks, contribute lightweight tooling, and help teams ship safer software with pragmatic mitigations and clear guidance.

You’ll work across product and engineering to triage vulnerabilities, translate findings into practical controls, and grow your offensive/defensive security skills in a

Qualifications

• 0–2+ years in application security or related fields.
• Proficiency in Python, JavaScript/TypeScript, or Kotlin.
• Comfort reading and reasoning about existing codebases.
• Experience with Git/GitHub workflows.
• Hands-on software or security experience.
• Ability to write scripts or small programs to automate tasks.
• Understanding of OWASP Top 10 and web security risks.
• Interest in offensive security and security certifications.
• Ability to reason about risk, impact, and mitigations.
• Strong product/engineering empathy.

Responsibilities

• Partner with product and engineering teams to identify application security risks and propose next steps.
• Read code, configurations, PRs, logs to understand systems and risks.
• Contribute small code changes, detections, tests, or automation.
• Review code in GitHub and track remediation work with engineers.
• Evaluate vulnerabilities from internal tests, bug bounties, tooling, or pen tests.
• Help triage, validate severity, and provide remediation guidance.
• Translate findings into repeatable security guidance and checklists.
• Work with engineers on design, data flows, and trust boundaries.
• Communicate risks clearly to technical and non-technical audiences.
• Build relationships across teams to influence security outcomes.
• Connect AppSec work to customer trust and regulatory expectations.
• Continue developing hands-on offensive/defensive skills.

Skills

0-2 years experience

Python

JavaScript/TypeScript

Kotlin

Git/GitHub

Code reading

Offensive security interest

Vulnerability management basics

Risk-based thinking

Communication skills

Collaborative mindset

Secure-by-design thinking

Tools

Burp Suite

Job description

Affirm invites an early-career Application Security Engineer to join our remote-first team focused on building trust and secure products. You will analyze code, configurations, and deployments to surface risks, contribute lightweight tooling, and help teams ship safer software with pragmatic mitigations and clear guidance.

You’ll work across product and engineering to triage vulnerabilities, translate findings into practical controls, and grow your offensive/defensive security skills in a