Product Security Engineer II

Affirm is seeking a Product Security Engineer II to join its Application Security team in a remote role based in Canada. This position focuses on identifying and mitigating application security risks across Affirm's products and platforms, working directly with product, engineering, infrastructure, and compliance teams to reduce business risk and support secure product launches.

Responsibilities

• Partner with product and engineering teams to identify application security risks and translate them into clear business impact, launch options, and mitigation recommendations
• Review application code, configuration, pull requests, logs, and documentation to identify security risks and understand system architectures
• Contribute code changes, scripts, detection logic, tests, secure defaults, and automation to improve application security workflows and reduce recurring vulnerabilities
• Work in GitHub to review code changes, participate in pull request discussions, track remediation efforts, and collaborate with engineering teams
• Evaluate vulnerabilities from internal testing, bug bounty submissions, security tooling, and penetration tests; partner with teams to prioritize and remediate based on actual risk
• Support vulnerability management workflows including triage, validation, severity assessment, remediation guidance, tracking, and reporting
• Convert recurring security findings into repeatable mechanisms such as secure coding guidance, automated detection, developer documentation, and code review patterns
• Analyze system designs, data flows, trust boundaries, authentication and authorization models, and potential abuse scenarios
• Communicate security issues clearly to both technical and non-technical stakeholders, explaining risk, tradeoffs, and recommended mitigations

Requirements

• Hands-on experience reading, analyzing, and reasoning about application code
• Practical software development or security engineering experience
• Active development of offensive security skills and familiarity with common vulnerability types and attack patterns
• Proficiency with GitHub and code review workflows
• Ability to work with vulnerability assessment tools and integrate findings into engineering processes

Benefits

• Remote work based in Canada