Affirm27 days ago
Инженер по безопасности продуктов II
Salary not specified
MARKET
15,000 ₽median for this role
CISO · 13 jobs with disclosed pay
7,333half of the offers: 9,600–17,69433,750
The employer didn't disclose pay — compare with the market yourself.
Remote US
Responsibilities
- 01Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps
- 02Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist
- 03Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues
- 04Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers
- 05Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk
- 06Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting
- 07Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation
- 08Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases
- 09Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk
- 10Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority
- 11Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes
- 12Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs
Requirements
- 010–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience
- 02Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar
- 03Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases
- 04Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking
- 05Some hands-on experience building, testing, breaking, or securing software
- 06Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes
- 07Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns
- 08Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments
- 09Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization
- 10Ability to reason about risk and tradeoffs, not just identify issues
- 11Strong product and engineering empathy
- 12Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms
- 13A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams
- 14Curiosity, humility, and a growth mindset
- 15Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction
What we offer
- 01Base Pay Grade - L
- 02Equity Grade - 6
- 03Employees new to Affirm typically come in at the start of the pay range