← All roles

Product Security Engineer II

Affirm· Information Security
Apply on company site
RemoteCA$133k - CA$183kFull-timePosted 2mo ago

About the role

Application Security Engineer focused on assessing application risks, vulnerability management, secure design collaboration, and tooling to scale AppSec across Affirm. Early-career role for someone with hands-on software or security experience, strong code reading ability, and interest in offensive security within a product-focused, risk-based framework.

Responsibilities

  • Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps.
  • Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist.
  • Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues.
  • Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers.
  • Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk.
  • Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting.
  • Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation.
  • Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases.
  • Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk.
  • Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority.
  • Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes.
  • Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs.

Qualifications

  • 4+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.
  • Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar.
  • Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
  • Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking.
  • Some hands-on experience building, testing, breaking, or securing software through professional experience, internships, labs, CTFs, bug bounty, open-source contributions, personal projects, automation scripts, internal tools, or coursework.
  • Ability to write clear, maintainable scripts or small programs to solve practical problems, automate workflows, analyze data, validate findings, or improve security processes.
  • Foundational understanding of common web, API, mobile, cloud, and application security risks (e.g., OWASP Top 10, authentication/authorization flaws, injection, insecure design, secrets exposure, dependency risks, data protection).
  • Interest in offensive security (certifications, testing, exploit development basics, Burp Suite, labs/CTFs).
  • Exposure to vulnerability management concepts (triage, severity assessment, remediation tracking, false positives, compensating controls, risk-based prioritization).
  • Ability to reason about risk and tradeoffs and explain potential impacts and mitigation options.
  • Strong product and engineering empathy; understand launch goals, constraints, user impact, and business priorities.
  • Clear written and verbal communication skills; ability to explain security findings practically.
  • Collaborative mindset across product, engineering, compliance, risk, infrastructure, and security teams.
  • Curiosity, humility, growth mindset; willingness to seek feedback and deepen technical depth.
  • Secure-by-design judgment to balance launch velocity with meaningful risk reduction.

Skills

Required:PythonJavaScript/TypeScriptCode reading and analysisGit & GitHub workflowsVulnerability managementCommunication

Benefits

  • Health coverage at no cost: 100% premiums for employees and dependents
  • Spending stipends for tech setup and health/wellness options
  • Flexible time off and generous holiday calendars
  • Employee stock purchase plan (ESPP) to buy Affirm stock at a discount
Last updated Sep 16, 2026. Interested? Apply on the company site.

About Affirm

Pay over time with flexible payment plans and no fees

Buy now pay later without the fees. Flexible payment options with longer plans, lower payments, and no fees. Pay in 4 interest-free or get more time and see your total cost upfront.

Buy now pay laterFinancial servicesPayment plansCredit
Company profileWebsite

More open roles at Affirm