Product Security Engineer II

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest. The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk. We are looking for an early-career Application Security Engineer who is curious, collaborative, and comfortable working with code.

• Partner with product and engineering teams to identify application security risks and frame them as business risks.
• Read application code, configuration, pull requests, logs, and documentation to understand systems and security risks.
• Contribute small code changes, scripts, detections, tests, secure defaults, or automation to improve AppSec workflows.
• Work in GitHub to review code changes, participate in pull request discussions, and collaborate with engineers.
• Evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources.
• Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting.
• Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, or developer-facing documentation.
• Communicate security issues clearly to technical and non-technical audiences.

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.
• Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar.
• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.
• Experience using Git and GitHub or similar version-control workflows.
• Some hands-on experience building, testing, breaking, or securing software.
• Ability to write clear, maintainable scripts or small programs to solve practical problems.
• Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues.
• Interest in offensive security, such as studying for certifications, practicing web/API testing, or using tools like Burp Suite.
• Exposure to vulnerability management concepts.
• Strong product and engineering empathy, clear communication, collaborative mindset, and secure-by-design judgment.

Base pay range per year: CAD $133,000 - $183,000. Employees new to Affirm typically come in at the start of the pay range. Total compensation may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). Employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).

• Health care coverage - Affirm covers all premiums for all levels of coverage for you and your dependents.
• Flexible Spending Wallets - generous stipends for spending on Technology, Food, various Lifestyle needs, and family forming expenses.
• Time off - competitive vacation and holiday schedules.
• ESPP - An employee stock purchase plan enabling you to buy shares of Affirm at a discount.

Remote Canada. This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan.

Apply via the job posting page.