Product Security Engineer II

Job not on LinkedIn

🔥 1 hour ago

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Affirm

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2012

💳 Fintech

👥 B2C

🛍️ eCommerce

💰 Post-IPO Equity on 2021-01

Fintech • B2C • eCommerce

Affirm is a financial technology company that offers a 'Buy Now, Pay Later' service, allowing consumers to make purchases and pay for them over time with flexible payment plans. Affirm eliminates hidden fees and compound interest, providing clear terms and conditions for its users. The company also offers the Affirm Card, a debit card that allows users to request to pay over time for larger purchases or pay in full for smaller ones. Affirm partners with various retailers across multiple categories, including electronics, apparel, and travel, providing customers with the convenience of paying over time at checkout both online and in physical stores. Affirm's services are integrated with Apple Pay, enabling customers to make payments seamlessly from their iPhone or iPad.

📋 Description

• Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps. • Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist. • Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues. • Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers. • Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk. • Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting. • Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation. • Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases. • Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk. • Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority. • Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes. • Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs.

🎯 Requirements

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience. • Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar. • Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases. • Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking. • Some hands-on experience building, testing, breaking, or securing software. This could include professional experience, internships, security labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework. • Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes. • Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns. • Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments. • Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization. • Ability to reason about risk and tradeoffs, not just identify issues. You can explain what could go wrong, how likely it is, what impact it may have, and what options exist to reduce risk. • Strong product and engineering empathy. You seek to understand launch goals, technical constraints, user impact, and business priorities before recommending a path forward. • Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms. • A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams. • Curiosity, humility, and a growth mindset. You proactively seek feedback, ask good questions, and continue building your technical depth. • Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction.

🏖️ Benefits

• Health care coverage - Affirm covers all premiums for all levels of coverage for you and your dependents • Flexible Spending Wallets - generous stipends for spending on Technology, Food, various Lifestyle needs, and family forming expenses • Time off - competitive vacation and holiday schedules allowing you to take time off to rest and recharge • ESPP - An employee stock purchase plan enabling you to buy shares of Affirm at a discount