Product Security Engineer, Affirm
CA$133-183k
+ ESPP
More information about location
Buy-now-pay-later card for online and in-store
Posted today
Buy-now-pay-later card for online and in-store
1001+ employees
Posted today
CA$133-183k
+ ESPP
More information about location
1001+ employees
Company mission
To deliver honest and transparent financial products that improve users' lives.
Role
Who you are
- We are looking for an early-career Application Security Engineer who is curious, collaborative, and comfortable working with code
- This role is a great fit for someone who has hands-on software or security experience, enjoys reading and reasoning about code, is actively developing offensive security skills, and wants to apply those skills in a product-minded, risk-based way
- 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience
- Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar
- Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases
- Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking
- Some hands-on experience building, testing, breaking, or securing software. This could include professional experience, internships, security labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework
- Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes
- Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns
- Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments
- Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization
- Ability to reason about risk and tradeoffs, not just identify issues. You can explain what could go wrong, how likely it is, what impact it may have, and what options exist to reduce risk
- Strong product and engineering empathy. You seek to understand launch goals, technical constraints, user impact, and business priorities before recommending a path forward
- Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms
- A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams
- Curiosity, humility, and a growth mindset. You proactively seek feedback, ask good questions, and continue building your technical depth
- Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction
What the job involves
- The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk. We partner closely with product, engineering, infrastructure, risk, compliance, and other teams to identify security risks early, recommend pragmatic mitigations, and help teams find safe paths to launch
- You will help assess application risks, support vulnerability management efforts, partner with engineering teams on secure design decisions, and contribute lightweight tooling, automation, and code-informed analysis that helps AppSec scale across Affirm
- Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps
- Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist
- Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues
- Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers
- Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk
- Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting
- Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation
- Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases
- Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk
- Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority
- Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes
- Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs
Our take
Affirm offers point-of-sale loans to consumers, working with merchants like Shopify, KAYAK, and Walmart. Buy now, pay later transactions have grown in popularity in recent years, and this business is tapping into the market with a totally different approach to credit - by delivering the Affirm card, the first US debit card with the option to pay-over-time.
Serving over 21 million consumers and over 300,000 merchants, the company offers flexible payback options ranging from 3 to 36 months. The interest rates run between 0% and 30%, so, while they are not necessarily the cheapest option, Affirm prides itself on having no fees for late payments, no hidden charges, and total transparency about what people will pay before they take out a loan.
Affirm collects payments from the customers and pays the merchants directly, shouldering the risk itself. The company has boosted its market share, expanding its availability beyond the US to include most of Canada, and continues to launch new features and create new partnerships towards bettering its offering.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
-11% employee growth in 12 months
Company
Funding (last 2 of 5 rounds)
Sep 2020
$500m
SERIES G
Apr 2019
$300m
SERIES F
Total funding: $1.1bn
Company benefits
- Compensation: We have a simple, flexible, and transparent remote-first compensation structure so you can make the best decisions for yourself and your family
- Spending Wallets: Access tech, food, lifestyle, and family planning wallets for your expenses
- Supportive Communities: Get involved with our employee resource groups and community groups
- Remote-first Workforce: If your role is remote, you can set up shop anywhere in your home country
- Generous Time Off: Take the time you need when life happens
- Health Benefits: Get a plan that fits your needs
- Mental Healthcare: Take care of your mind with great mental health programs
- Parental Leave: Birth and non-birth parents get 18 weeks’ paid leave. Plus, a 4-week return-to-work transition program, at full base pay
- Away Days: We offer 20 company-wide paid days off—which help our teams collectively pause to recharge
- Learning & Development: Engage in exciting learning programs to level up your growth
Company HQ
Chinatown, San Francisco, CA
Leadership
Max Levchin
(Co-Founder & CEO)Has founded/co-founded numerous companies, holding various executive positions at each, including Paypal, Slide, Glow, HVF Labs, and SciFi VC. Also worked at large brands including Google, Yelp, Yahoo, and Evernote.
Share this job
View 137 more jobs at Affirm