About the company
The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk. The team partners with product, engineering, infrastructure, risk, and compliance teams to identify security risks early.
Responsibilities
- Partner with product and engineering teams to identify application security risks and frame them as clear business risks
- Read application code, configuration, pull requests, logs, and documentation to understand systems and security risks
- Contribute code changes, scripts, detections, tests, secure defaults, and automation to improve AppSec workflows
- Work in GitHub to review code changes, participate in pull request discussions, and track remediation work
- Evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, and penetration tests
- Contribute to vulnerability management workflows including triage, validation, severity assessment, and reporting
- Translate recurring security findings into repeatable mechanisms such as secure coding guidance and automation
- Communicate security issues clearly to technical and non-technical audiences
Requirements
- 4+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, or security operations
- Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or similar
- Comfort reading and reasoning about code in unfamiliar codebases
- Experience using Git and GitHub or similar version-control workflows
- Foundational understanding of web, API, mobile, cloud, and application security risks (OWASP Top 10, authentication/authorization flaws, injection, secrets exposure, dependency risks)
- Interest in offensive security (Burp Suite, CTFs, security certifications)
- Exposure to vulnerability management concepts
- Clear written and verbal communication skills
- Collaborative mindset and growth mindset