Remote Product Security Engineer II - Secure What We Build

Affirm; Madison (WI); On-site; USD 146,000 - 206,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP

Job summary

Affirm is a remote-first company redefining credit with customer trust at the core. We seek an early-career Application Security Engineer who enjoys reading code, developing offensive/defensive skills, and delivering lightweight tooling to scale AppSec across Affirm.

You will assess risks, support vulnerability management, and partner with engineering to drive secure design decisions while contributing to automation and developer-facing guidance.

Qualifications

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.
• Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
• Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking.
• Some hands-on experience building, testing, breaking, or securing software.
• Ability to write clear, maintainable scripts or small programs to solve practical problems.
• Foundational understanding of common web, API, mobile, cloud, and application security risks (OWASP Top 10, authn/authz, injection, etc.).
• Interest in offensive security, such as certifications or security labs.
• Exposure to vulnerability management concepts (triage, remediation tracking, risk-based prioritization).
• Ability to reason about risk and tradeoffs and explain impact and mitigations.
• Strong product and engineering empathy to align with launch goals and constraints.
• Clear written and verbal communication to explain findings.
• Collaborative mindset to work across product, engineering, risk, compliance, and security teams.
• Curiosity, humility, and a growth mindset.
• Secure-by-design judgment to balance velocity and risk reduction.

Responsibilities

• Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps.
• Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist.
• Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows.
• Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work.
• Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; prioritize and remediate issues based on risk.
• Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting.
• Translate recurring security findings into secure coding guidance, checklists, reusable patterns, or developer-facing documentation.
• Work with engineers to understand system designs, data flows, trust boundaries, authentication/authorization models, code paths, and abuse cases.
• Communicate security issues clearly to technical and non-technical audiences with risk, tradeoffs, mitigations, and residual risk.
• Build relationships across affirm teams to influence security outcomes without formal authority.
• Connect AppSec work to customer trust, regulatory expectations, operational resilience, and business outcomes.
• Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, certifications, or contributions to internal security programs.

Skills

Python

JavaScript/TypeScript

Kotlin

Tools

Git & GitHub

Job description

Affirm is a remote-first company redefining credit with customer trust at the core. We seek an early-career Application Security Engineer who enjoys reading code, developing offensive/defensive skills, and delivering lightweight tooling to scale AppSec across Affirm.

You will assess risks, support vulnerability management, and partner with engineering to drive secure design decisions while contributing to automation and developer-facing guidance.