Secure-by-Design Product Security Engineer II

Affirm; St. Louis (MO); On-site; USD 146,000 - 206,000; Full time

Benefits offered by this job

Health care coverage

Flexible Spending Wallets

Time off

ESPP - Employee Stock Purchase Plan

Job summary

Affirm, a remote-first company, is seeking an early-career Application Security Engineer to assess application risks, support vulnerability management, and partner with product and engineering on secure design decisions.

You will contribute lightweight tooling, review code in GitHub, translate findings into actionable guidance, and help scale AppSec across affirm while balancing launch velocity and risk.

Qualifications

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, or equivalent practical experience.
• Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
• Experience using Git and GitHub or similar version-control workflows.
• Some hands-on experience building, testing, breaking, or securing software.

Responsibilities

• Identify application security risks with product and engineering teams and frame them as clear business risks, launch options, and next steps.
• Read application code, configuration, pull requests, logs, and docs to understand system behavior and risks.
• Contribute small code changes, scripts, detections, tests, such as secure defaults and automation.
• Review code changes in GitHub, discuss context, track remediation work, and collaborate with engineers.
• Evaluate vulnerabilities from internal testing, bug bounty, tooling, or pen tests and prioritize remediation based on risk.

Skills

Python

JavaScript/TypeScript

Kotlin

Git & GitHub

Tools

GitHub

Job description

Affirm, a remote-first company, is seeking an early-career Application Security Engineer to assess application risks, support vulnerability management, and partner with product and engineering on secure design decisions.

You will contribute lightweight tooling, review code in GitHub, translate findings into actionable guidance, and help scale AppSec across affirm while balancing launch velocity and risk.