Remote Product Security Engineer II: Secure Innovative Apps

Affirm; Boulder (CO); On-site; USD 146,000 - 206,000; Full time

Benefits offered by this job

Health insurance

ESPP

Time off

Job summary

Affirm is seeking an early-career Application Security Engineer to assess risks, support vulnerability management, and partner with engineering on secure design decisions while contributing lightweight tooling and automation. You will read code, review changes in GitHub, triage vulnerabilities, and translate findings into practical guidance.

This remote-first role offers growth in product security, learning opportunities, and collaboration across product, risk, and compliance teams.

Qualifications

• 0–2+ years of experience in application security, software engineering, or equivalent practical experience.
• Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading and reasoning about code and unfamiliar codebases.
• Experience using Git and GitHub or similar version-control workflows.

Responsibilities

• Identify application security risks with product and engineering teams, framing them as business risks and actionable next steps.
• Read application code, configuration, logs, and PRs to understand systems and risks.
• Contribute small code changes, scripts, detections, or automation to improve AppSec workflows.
• Review code changes in GitHub and track remediation work with engineers.
• Evaluate vulnerabilities from internal tests, bug bounties, or tooling and help prioritize remediation.
• Develop secure coding guidance and lightweight automation to repeat security improvements.
• Communicate security findings clearly to technical and non-technical audiences.

Skills

Python

JavaScript/TypeScript

Kotlin

Git and GitHub

Vulnerability management

Tools

GitHub

Burp Suite

SAST/DAST tooling

Job description

Affirm is seeking an early-career Application Security Engineer to assess risks, support vulnerability management, and partner with engineering on secure design decisions while contributing lightweight tooling and automation. You will read code, review changes in GitHub, triage vulnerabilities, and translate findings into practical guidance.

This remote-first role offers growth in product security, learning opportunities, and collaboration across product, risk, and compliance teams.