Product Security Engineer II

This is a fully remote position, open to applicants in California, +4 more states.

📋 Description

• Collaborate with product and engineering teams to identify application security threats and articulate them as clear business risks, suggesting options for action and next steps.

• Analyze application code, configuration, pull requests, logs, and documentation to gain insights into system functionality and potential security vulnerabilities.

• Implement minor code modifications, scripts, detections, tests, secure defaults, or automation to enhance AppSec workflows and minimize recurring problems.

• Engage in GitHub to assess code modifications, comprehend engineering context, join pull request discussions, monitor remediation efforts, and work alongside engineers.

• Assist in evaluating vulnerabilities from internal assessments, bug bounty submissions, security tools, penetration tests, and other sources; partner with teams to prioritize and address issues based on real-world risk factors.

• Contribute to vulnerability management processes, covering triage, validation, severity evaluation, remediation advice, tracking, and reporting.

• Convert recurring security findings into repeatable processes such as secure coding guidelines, checklists, standardized paths, lightweight automation, detection logic, reusable review patterns, or developer-oriented documentation.

• Collaborate with engineers to comprehend system architectures, data flows, trust boundaries, authentication and authorization frameworks, code execution paths, and possible misuse scenarios.

• Clearly communicate security concerns to both technical and non-technical stakeholders, including associated risks, tradeoffs, mitigation recommendations, and residual risks.

• Foster strong relationships across Affirm teams and influence security results without relying on formal authority.

• Link AppSec initiatives to customer trust, regulatory and compliance expectations, operational resilience, and business results.

• Continuously enhance hands-on offensive, defensive, and software engineering skills through practical experience, labs, tools, research, certifications, or contributions to internal security initiatives.

⛳️ Requirements

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.

• Basic programming skills in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar.

• Comfort in reading, navigating, and reasoning about code, even in unfamiliar codebases.

• Familiarity with Git and GitHub or similar version-control systems, including branches, commits, pull requests, code reviews, issues, or project tracking.

• Some hands-on experience in building, testing, breaking, or securing software. This may include professional roles, internships, security labs, CTFs, bug bounty projects, open-source contributions, personal projects, automation scripts, internal tools, or academic coursework.

• Capability to write clear, maintainable scripts or small applications to address practical challenges, automate manual tasks, analyze data, validate results, or enhance security processes.

• Foundational knowledge of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 vulnerabilities, authentication and authorization flaws, injection issues, insecure design, secrets exposure, dependency vulnerabilities, and data protection challenges.

• Interest in offensive security, including pursuing or achieving security certifications, practicing web/API testing, learning the fundamentals of exploit development, using tools like Burp Suite, or participating in labs and capture-the-flag events.

• Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization.

• Ability to assess risk and tradeoffs, not just identify issues. You can articulate potential problems, their likelihood, possible impacts, and options for risk mitigation.

• Strong empathy for product and engineering. You strive to understand launch objectives, technical limitations, user impacts, and business priorities before suggesting a course of action.

• Excellent written and verbal communication skills, enabling you to present security findings in practical, actionable language.

• A collaborative approach and comfort working with product, engineering, compliance, risk, infrastructure, and security teams.

• A curious, humble, and growth-oriented mindset. You actively seek feedback, pose insightful questions, and continue to deepen your technical expertise.

• Secure-by-design judgment, including the ability to recognize patterns, recommend straightforward controls, and balance launch speed with effective risk reduction.

🏝️ Benefits

• Health care coverage - Affirm covers all premiums for all levels of coverage for you and your dependents.

• Flexible Spending Wallets - generous stipends for spending on Technology, Food, various Lifestyle needs, and family-forming expenses.

• Time off - competitive vacation and holiday schedules allowing you to take time off to rest and recharge.

• ESPP - An employee stock purchase plan enabling you to buy shares of Affirm at a discount.