Product Security Engineer

Join Affirm's Application Security team as an early-career Application Security Engineer. In this role, you will assess application risks, support vulnerability management efforts, and partner with engineering teams on secure design decisions. You will contribute to lightweight tooling, automation, and code-informed analysis to help scale AppSec across Affirm. This position is ideal for someone with hands-on software or security experience who enjoys reading and reasoning about code and wants to apply those skills in a product-minded, risk-based way.

Responsibilities

• Collaborer avec les équipes produit et ingénierie pour identifier les risques de sécurité des applications et les encadrer en tant que risques commerciaux clairs.
• Lire le code des applications, la configuration, les demandes de tirage, les journaux et la documentation pour comprendre comment les systèmes fonctionnent et où des risques de sécurité peuvent exister.
• Contribuer à l'évaluation des vulnérabilités, à la gestion des vulnérabilités, à la triage, à la validation, à l'évaluation de la gravité, aux conseils de remédiation, au suivi et à la reporting.
• 4+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience
• Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking

Requirements

• Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization
• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases
• Strong product and engineering empathy. You seek to understand launch goals, technical constraints, user impact, and business priorities before recommending a path forward
• Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms
• Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar
• A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams
• Curiosity, humility, and a growth mindset. You proactively seek feedback, ask good questions, and continue building your technical depth
• Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction
• Some hands-on experience building, testing, breaking, or securing software. This could include professional experience, internships, security labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework
• Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes
• Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns
• Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments
• Ability to reason about risk and tradeoffs, not just identify issues. You can explain what could go wrong, how likely it is, what impact it may have, and what options exist to reduce risk