2 months ago
Remote, CanadaMid Level
Responsibilities
- Partner with product and engineering teams to identify application security risks and frame business risks, launch options, and recommended next steps.
- Review application code, configuration, pull requests, logs, and documentation to identify security risks.
- Contribute code changes, scripts, detections, tests, secure defaults, and automation that improve Application Security workflows.
- Use GitHub to review code changes, participate in pull request discussions, track remediation, and collaborate with engineers.
- Evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources, then help prioritize and remediate them.
- Support vulnerability management through triage, validation, severity assessment, remediation guidance, tracking, and reporting.
- Turn recurring findings into secure coding guidance, checklists, paved paths, automation, detection logic, reusable review patterns, and developer documentation.
- Analyze system designs, data flows, trust boundaries, authentication and authorization models, code paths, and abuse cases.
- Communicate security issues, tradeoffs, mitigations, and residual risk to technical and non-technical audiences.
- Build cross-functional relationships and influence security outcomes without formal authority.
- Connect Application Security work to customer trust, compliance, operational resilience, and business outcomes.
- Continue developing offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, and internal security programs.
Requirements
- 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.
- Foundational programming ability in Python, JavaScript/TypeScript, Kotlin, or a similar language.
- Ability to read, navigate, and reason about unfamiliar codebases.
- Experience with Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code reviews, issues, or project tracking.
- Hands-on experience building, testing, breaking, or securing software through professional work, internships, labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework.
- Ability to write clear, maintainable scripts or small programs for automation, data analysis, finding validation, or security process improvement.
- Foundational understanding of web, API, mobile, cloud, and application security risks, including OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns.
- Interest in offensive security through certifications, web/API testing, exploit development fundamentals, Burp Suite, labs, or capture-the-flag environments.
- Exposure to vulnerability management, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization.
- Ability to reason about risk, impact, likelihood, tradeoffs, and mitigation options.
- Strong product and engineering empathy, clear communication skills, and the ability to collaborate across product, engineering, compliance, risk, infrastructure, and security teams.
Benefits
- Remote-first role open to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan.
- Affirm covers health care premiums for employees and dependents, including medical, dental, and vision coverage.
- Flexible Spending Wallets provide stipends for technology, food, lifestyle, and family-forming expenses.
- Competitive vacation and holiday schedules.
- Employee stock purchase plan enabling employees to buy Affirm shares at a discount.
- Reasonable accommodations are available during the interview process.
Tech Stack
Categories
About Affirm
Affirm provides buy now, pay later installment financing at online and in-store checkout, along with a consumer app and virtual card, for shoppers and merchants. It monetizes through merchant fees and interest on select loans, with no late fees. Founded in 2012 and headquartered in San Francisco, Affirm is a public company listed on NASDAQ that powers payments for thousands of ecommerce retailers.