Affirm

Product Security Engineer II

Affirm • $146K — $206K *
US-AnywhereRemote in United States
Information Technology
Less than 5 years of experience
Today
Be an Early Applicant
Job Overview by Ladders

Qualifications

  • 0-2+ years of experience in application security or related fields.
  • Foundational programming skills in Python, JavaScript/TypeScript, or Kotlin.
  • Ability to navigate and understand complex codebases.
  • Experience with Git and GitHub for version control and collaboration.
  • Hands-on experience in security practices such as penetration testing or vulnerability management.
  • Strong understanding of common security risks like OWASP Top 10.
  • Excellent written and verbal communication skills for conveying security issues.

Responsibilities

  • Partner with product and engineering teams to identify and frame application security risks.
  • Analyze code, configurations, and logs to detect security vulnerabilities.
  • Contribute code changes and automation to enhance AppSec workflows.
  • Review code in GitHub, participate in discussions, and track remediation efforts.
  • Evaluate and prioritize vulnerabilities based on real-world impact.
  • Manage vulnerability workflows, including triage and reporting.
  • Translate findings into actionable secure coding guidance and reusable documentation.

Benefits

  • 100% subsidized medical coverage for you and your dependents.
  • Generous stipends for technology, food, and lifestyle expenses.
  • Competitive vacation and holiday schedules for time off.
  • Discounted employee stock purchase plan (ESPP) for acquiring shares of Affirm.
Full Job Description
What You'll Do
  • Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps.
  • Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist.
  • Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues.
  • Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers.
  • Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk.
  • Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting.
  • Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation.
  • Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases.
  • Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk.
  • Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority.
  • Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes.
  • Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs.
What We Look For
  • 0-2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.
  • Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar.
  • Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
  • Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking.
  • Some hands-on experience building, testing, breaking, or securing software. This could include professional experience, internships, security labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework.
  • Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes.
  • Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns.
  • Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments.
  • Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization.
  • Ability to reason about risk and tradeoffs, not just identify issues. You can explain what could go wrong, how likely it is, what impact it may have, and what options exist to reduce risk.
  • Strong product and engineering empathy. You seek to understand launch goals, technical constraints, user impact, and business priorities before recommending a path forward.
  • Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms.
  • A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams.
  • Curiosity, humility, and a growth mindset. You proactively seek feedback, ask good questions, and continue building your technical depth.
  • Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction.


Base Pay Grade - L

Equity Grade - 6

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include equity rewards, monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents.)

USA base pay range (CA, WA, NY, NJ, CT): $165,000 - $225,000

USA base pay range (all other U.S. states): $146,000 - $206,000

#LI-Remote

Affirm is proud to be a remote-first company! The majority of our roles are remote and you can work almost anywhere within the country of employment. Affirmers in proximal roles have the flexibility to work remotely, but will occasionally be required to work out of their assigned Affirm office. A limited number of roles remain office-based due to the nature of their job responsibilities.

We're extremely proud to offer competitive benefits that are anchored to our core value of people come first. Some key highlights of our benefits package include:
  • Health care coverage - Affirm covers all premiums for all levels of coverage for you and your dependents
  • Flexible Spending Wallets - generous stipends for spending on Technology, Food, various Lifestyle needs, and family forming expenses
  • Time off - competitive vacation and holiday schedules allowing you to take time off to rest and recharge
  • ESPP - An employee stock purchase plan enabling you to buy shares of Affirm at a discount

About Affirm

Affirm is a publicly traded financial technology company headquartered in San Francisco, United States. Founded in 2012, the company operates as a financial lender of installment loans for consumers to use at the point of sale to finance a purchase. Affirm was founded in 2012 by Max Levchin, Nathan Gettings, Jeffrey Kaditz, and Alex Rampell as part of the initial portfolio of startup studio HVF. Levchin, who co-founded PayPal, became CEO of Affirm in 2014. In October 2017, the company launched a consumer app that allowed loans for purchases at any retailer. The company announced a partnership with Walmart in February 2019. Under the partnership, Affirm is available to customers in-store and on the Walmart website. Affirm has partnered with e-commerce platforms including Shopify, BigCommerce, and Zen-Cart. On November 18, 2020, Affirm filed with the Securities and Exchange Commission in preparation for an initial public offering. On December 12, 2020, it was reported that Affirm had postponed its IPO. On January 13, 2021, Affirm became listed on NASDAQ with symbol AFRM, raising about $1.2 billion in its IPO. By the next day, the price of shares had doubled, making Levchin's stake worth about $2.5 billion. In May 2021, Affirm acquired Returnly, a financial technology service company, for $300 million.
Learn more about Affirm
Size
1,300 employees
Market Cap
$2.5 billion
Industry
Finance & Insurance
Net Income
-$97.6 million
Founded
2012
Revenue
$617.1 million
NASDAQ
AFRM
* Ladders Estimates

Similar Jobs

Ad banner background

Get Ready For Your
Next Interview

More Jobs at Affirm

More Information Technology Jobs

Find similar Product Security Engineer II jobs:

NationwideRemote