Remote Product Security Engineer II - Early-Career

Affirm; Boston (MA); On-site; USD 146,000 - 225,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is seeking an early-career Application Security Engineer to assess application risks, support vulnerability management, and partner with engineering on secure design decisions. You will contribute lightweight tooling, automation, and code-informed analysis to scale AppSec across Affirm.

The role emphasizes reading code, working with GitHub, and communicating security findings to both technical and non-technical audiences, with opportunities to grow offensive/defensive security skills in a

Qualifications

• Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar.
• Ability to read, navigate, and reason about codebases.

Responsibilities

• Partner with product and engineering teams to identify application security risks and frame them as clear business risks, launch options, and next steps.
• Read application code, configuration, pull requests, logs, and documentation to understand system behavior and risks.
• Contribute small code changes, scripts, detections, tests, or automation to improve AppSec workflows.
• Review code changes in GitHub, discuss engineering context, track remediation work, and collaborate with engineers.
• Evaluate vulnerabilities from internal testing, bug bounty reports, tooling, penetration tests, and other sources; prioritize and remediate with risk-based thinking.
• Contribute to vulnerability management workflows including triage, severity assessment, remediation guidance, and reporting.
• Translate recurring findings into secure coding guidance, checklists, and reusable review patterns.

Skills

Python

JavaScript/TypeScript

Kotlin

Git/GitHub

Automation scripting

Offensive security interest

Tools

GitHub

Job description

Affirm is seeking an early-career Application Security Engineer to assess application risks, support vulnerability management, and partner with engineering on secure design decisions. You will contribute lightweight tooling, automation, and code-informed analysis to scale AppSec across Affirm.

The role emphasizes reading code, working with GitHub, and communicating security findings to both technical and non-technical audiences, with opportunities to grow offensive/defensive security skills in a