We are a hybrid, remote-office company dedicated to growing our talent anywhere!

We have onsite locations in: Sioux Falls, SD,  Scottsdale, AZ,  Louisville, KY,  Troy, MI,  Franklin, TN,  Easton, PA.

At Pathward, we take tremendous pride in our purpose to create financial inclusion for all™. We are a financial empowerment company that works with innovators to increase financial availability, choice, and opportunity for all.  We strive to remove barriers that traditional institutions put in the way of financial access, and promote economic mobility by providing responsible, secure, high quality financial products.

We are a team of problem solvers and innovators who celebrate our differences and know that our unique perspectives make us stronger and well-positioned for success.  We celebrate, and embrace, our team members through our *HUMBLE*HUNGRY*SMART approach, and we believe that we are strongest when we embrace the voices of our employees, customers, partners, and the communities we serve.

About the Role:

The position is responsible for performing audits within Information Technology for the purpose of ensuring compliance with external regulations as well as internal policies.  It will also communicate audit findings to multiple stakeholder groups.

What You Will Do:

• Collaborate with audit team members as well as members of IT to develop audit objectives, engagement scopes, and testing strategies aligned with departmental standards and risk priorities.
• Assist in the planning, execution, and reporting of IT audit engagements, including SOX ITGC testing, risk-based technology reviews, and issue validation procedures. Assist in the department’s risk assessment processes, providing qualitative/quantitative analysis over the Company’s auditable entities, and ensuring alignment with audit stakeholders.
• Analyze and summarize data to identify control deficiencies, process inefficiencies, or noncompliance with policies, procedures, or regulations. Communicate findings and recommendations to audit leadership and business stakeholders in a clear manner. Utilize data analytics to test large datasets, identify anomalies, and draw insights that enhance audit efficiency and coverage.
• Monitor issued audit findings, perform validation testing over defined remediation plans, and present remediation statuses to stakeholders. Identify opportunities to strengthen controls, improve operational effectiveness, and reduce risk exposure across technology and business processes.
• Other duties as assigned

What You Will Need:

• Bachelor’s degree or equivalent education and work experience.

• Up to 2+ years with bachelor’s or equivalent.

• Communication skills (written and verbal)

• Collaboration and building relationships

• Attention to detail

• Learning agility

The responsibilities listed above are not all inclusive and may be changed at any time.

Salary range:  $50,000 – $84,000

The salary range reflects the minimum and maximum target for a new hire in this role. Individual pay within the range will be determined by multiple factors which can include but are not limited to a candidate’s experience, qualifications, skills, and location. Your recruiter can share more about the specific salary for your location during the hiring process. Ranges may be modified in the future.

This role is also eligible for an annual performance-based incentive opportunity.  Pathward offers a comprehensive benefits package for eligible employees, including health insurance, 401(k) retirement benefits, life insurance, disability benefits, paid time off, and more.

#LI-Remote

Don’t have everything listed under qualifications? If you’re excited about this role but your experiences don’t match exactly to everything in the posting, we encourage you to apply anyway. You may be just the right candidate for this or other Pathward roles. Pathward is an equal employment opportunity employer and considers candidates for roles without regard to their race, sex, national origin, ethnicity, age, disability or any other category protected by law.

Who we are:

Our commitment to inclusion is woven into our DNA. We believe that we are strongest when we embrace the voices of our employees, customers, partners, and the communities we serve.

We provide equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, ethnicity, religion, sex, sexual orientation, gender identity, transgender status, pregnancy, national origin, age (age 40 and over), disability, genetic information, marital status, hair texture or hairstyle, ancestry, service in the uniformed services, protected veteran status, status as a victim of domestic violence or any other class protected by federal, state and local laws.

Please click here to learn more about our benefits and review information about our Privacy Policy, Affirmative Action Plan and other notices. Applicants with disabilities may be entitled to reasonable accommodation under the terms of the Americans with Disabilities Act and certain state or local laws. For assistance completing an application, please contact a Pathward People & Culture Representative by emailing – careers@pathward.com

Please click here to view Pathward’s Applicant Privacy Notice.

Applications will be accepted for a minimum of 3 days after posting, and there is no predetermined date by which applications should be submitted.

Knowingly submitting false information will result in disqualification for consideration of future positions, termination of employment and forfeiture of other rights.

Candidate Scam Warning

We encourage you to be cautious of hiring scams that impersonate Pathward. Copy and paste the following URL into your browser to learn more: https://www.pathward.com/about-us/people-culture/careers/

SpecterOps is looking for an Associate Offensive Security Consultant to work on the Consulting Services team as operators, trainers, and program developers. The Adversary Simulation service line primarily works in large commercial enterprises conducting offensive security assessment services (red team assessments, penetration tests, offensive maturity assessments, web application tests, and specialty security assessments), supporting internal offensive programs, delivering training courses, and supporting research and development efforts. Our consultants work both onsite and offsite in diverse environments supporting our customers, anywhere from developing toolsets in support of operations to briefing executives.

A successful candidate will have excellent technical skills, impeccable soft skills, and be a well-organized, self-directed individual.

Salary Range: Base salary annually, commensurate with experience.

• Associate Consultant - $100,000 - $125,000

Location: This position is remote, based in the U.S. with travel quarterly for in person company events and other ad hoc meetings.

• Candidate must be authorized to work and reside in the United States; we do not currently sponsor immigration visas

Responsibilities

• Plan and conduct offensive security engagements ranging in size, scope, focus, and approach
• Effectively communicate findings, attack paths, recommendations, and strategy to technical and executive client stakeholders through written reports and verbal presentations
• Build scripts, tools, or methodologies to enhance offensive services
• Serve as a subject matter expert (SME) in one of the following areas: initial access, open-source intelligence analysis, adversary tradecraft, offensive Windows/Linux/macOS operations, evasion operations, or technical capability development
• Utilize common offensive security testing tools and tradecraft
• Stay up to date with cutting-edge adversary tradecraft and vulnerabilities
• Effectively communicate successes and obstacles with fellow team members and team lead(s)
• Interface with client contact(s) and staff in a constructive and professional manner
• Coordinate and prepare for internal and customer facing meetings
• Assist with scoping prospective engagements, participating in technical testing from kickoff through remediation, and mentoring less experienced staff
• Train team members in adversary Tactics, Techniques, and Procedures (TTPs) and tools
• Contribute new or improve existing content for SpecterOps training courses and assist in the delivery of course offerings (instruction, lab support, etc.)

Requirements

• Ability to travel domestically and internationally; up to an average of 25% annually
• Must be able to pass a criminal background check
• Desire to embody our core values of passionate curiosity, consistent improvement, empathy, sustainability, humility, and empowerment through transparency

Associate Consultant:

As an Associate Consultant, your primary responsibility will be to learn. You will engage in, participate in, and contribute to the execution of various services and projects. In doing so, you will develop a foundational understanding of the SpecterOps Adversary Simulation service line and enhance your skills in one or more technical areas.

Desired Qualifications:

• Foundational knowledge of offensive security concepts and assessments
• Foundational knowledge of security principles, policies, and industry best practices
• Working knowledge of Windows and *NIX-based operating systems
• Working knowledge of networking concepts
• Working knowledge of Active Directory
• Working knowledge of programming or scripting languages, such as C#/.NET, C++, Python, PowerShell, Bash, etc.
• Aptitude for technical writing, including assessment reports, presentations and operating procedures
• Proficient written/verbal communication and interpersonal skills
• A strong determination to improve both personal skills and the overall information security community through research efforts, including blog posts, conference presentations, open-source tool releases, and white paper publications
• Willingness to support the delivery of public and private training offerings (e.g. providing lab support, addressing student questions, etc.)

Nice to Haves

• Bachelor’s degree in a technical field
• Experience participating in and/or leading Fortune 1000 and/or large Federal Government security assessments
• Public community contributions (e.g., conference presentations, blog posts, white papers, public tool development)
• Experience in administering, attacking, or defending Windows/Active Directory, Linux, and/or macOS environments
• Experience in technical writing
• Experience working for a service-based information security consultancy
• Experience developing and/or providing technical training
• Desire to teach and train students in offensive techniques
• Desire to travel internationally and domestically on a more frequent basis

What We Offer

• Health/Dental/Vision/life insurance: 100% covered for both the employee and their family
• Flexible time off policy
• 13 paid holidays annually
• 401(k) with up to 4% company match
• Equity and quarterly bonuses based on company performance
• Remote work: $1,500 first year allowance to set up home office
• $500 annual home office allowance after first year
• $150 monthly cell phone and internet reimbursement
• $5,000 annual professional development allowance
• $5,250 towards continuing education or student loan repayment
• $1,200 annual budget for lifestyle, wellness, pet insurance and more
• A one-time $10,000 benefit towards family planning
• Open intellectual property policies; allow researchers to retain rights over open-sourced research & tools
• In person and virtual employee events throughout the year
• And of course, company swag!

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status. To request reasonable accommodations, please contact us at careers@specterops.io

Unsolicited resumes are not accepted

#LI-REMOTE

Remote (+/- 2hrs from Germany GMT+1). C2 German Language is essential

At Secfix, we’re at the forefront of automating security compliance in Europe. We help companies get and stay ISO 27001, GDPR, TISAX, and SOC 2 fast and easy and reduce hundreds of hours of manual work.

Secfix is run by a 100% remote team with hubs in Munich, Berlin and London. We’re a high-performing team looking for passionate, execution-focused, owners to help us automate security and compliance for modern companies and become the European compliance automation leader.

We’ve just raised our $12M Series A and are backed by top VCs, including Alstin Capital, Neosfer (Commerzbank), and Bayern Capital.

About the Role

We’re hiring an ISO 27001 Internal Auditor to own our internal audits end to end. You stay independent from the implementation work. You audit what a customer has built, review their evidence on the Secfix platform, and give them a clear report before their external audit. You assess, you find what is missing, and you tell them in plain language exactly what to do about it. This is a hands-on individual contributor role with full ownership of a function customers trust us with.

What You’ll Do:

You will own internal audits to make our customers ready for their certification. We give you full context and best practices, and you own how you deliver the results. You will:

• Own internal audits for our customers end to end, from kickoff through to the final report they take into their external audit

• Review and sample evidence on the Secfix platform and assess it against the relevant ISO 27001 controls

• Run the customer calls and walk customers through your findings and any non-conformities

• Catch the non-conformities that matter, including the easy ones, so nothing avoidable surfaces later in an external audit

• Write findings a non-technical founder can act on: what is missing, why it matters, and what to do next

• Keep several audits moving at once and keep every one on schedule

• Stay neutral to the implementation and hold a clean line between auditing and helping

• Learn our other frameworks (TISAX, ISO 42001) and help build a repeatable audit structure for them

• Help improve framework content on the platform, including evidence examples and guidance

• Share structured product feedback when you spot recurring issues in the platform

About You:

• German (C1/C2) and English (fluent) are a must for this role

• Up to 2 years of information security background

• Hands-on ISO 27001 internal audit experience, with at least 10+ internal audits you have personally run

• A PECB ISO 27001 Lead Auditor certification or a direct equivalent

• Direct experience auditing inside a modern GRC platform

• Clear, concrete written and spoken English, with the ability to explain complex requirements simply

Nice-to-have:

• Experience auditing or implementing TISAX, ISO 42001, NIS2 or SOC 2

• Experience at an early-stage startup (Seed to Series B)

• Exposure to a modern SaaS product and cross-functional work with product teams

What we offer

• Remote Work: 100% remote work with a virtual office in Gather.

• Competitive Salary: Industry-competitive local salaries.We pay local rates that are at or above the market. We share this philosophy with GitLab.

• Equity: Generous equity package – we’re all owners of Secfix and beneficiaries of our collective success.

• Mentorship: We are backed by top VCs and accelerators and have direct access to world-class mentors.

• Development Budget: €1,000 annual personal development budget.

• Home office Budget: Home office budget and access to co-working spaces.

• Holidays: 26 days holiday + local public holidays.

• Health Insurance: Comprehensive health coverage.

• Annual Retreat: Annual retreat to build connections and inspire ideas (this year we’re headed to Alicante!).

• Company Events: Company-wide events to build relationships and have some fun!

• Tech Equipment: Latest tech equipment (MacBook, monitors, headphones).

Interview Process:

• 45 min - Intro call with Talent team

• Take-home Assessment

• 1.5hr Assessment review and interview with Compliance Team

• 45 min - Final Founder Interview with CTO

Please note: We are an equal-opportunity employer and a remote-only company. At this time, we can support hiring only within EU time zones. We work in sync using Gather as our virtual office. As a small fast-growing company, we believe in the need for an in-sync component of daily communication and therefore cannot support 100% asynchronous work. Read more about our Remote Culture here .

Transition to a Career in Cybersecurity at a Dynamic Cybersecurity Company The cybersecurity industry is poised to grow by double digits again this year.

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest.

About the InfoSec & IT Team

The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk. We partner closely with product, engineering, infrastructure, risk, compliance, and other teams to identify security risks early, recommend pragmatic mitigations, and help teams find safe paths to launch.

We are looking for an early-career Application Security Engineer who is curious, collaborative, and comfortable working with code. You will help assess application risks, support vulnerability management efforts, partner with engineering teams on secure design decisions, and contribute lightweight tooling, automation, and code-informed analysis that helps AppSec scale across Affirm.

This role is a great fit for someone who has hands-on software or security experience, enjoys reading and reasoning about code, is actively developing offensive security skills, and wants to apply those skills in a product-minded, risk-based way.

What You’ll Do

• Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps.

• Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist.

• Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues.

• Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers.

• Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk.

• Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting.

• Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation.

• Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases.

• Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk.

• Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority.

• Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes.

• Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs.

What We Look For

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.

• Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar.

• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.

• Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking.

• Some hands-on experience building, testing, breaking, or securing software. This could include professional experience, internships, security labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework.

• Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes.

• Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns.

• Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments.

• Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization.

• Ability to reason about risk and tradeoffs, not just identify issues. You can explain what could go wrong, how likely it is, what impact it may have, and what options exist to reduce risk.

• Strong product and engineering empathy. You seek to understand launch goals, technical constraints, user impact, and business priorities before recommending a path forward.

• Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms.

• A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams.

• Curiosity, humility, and a growth mindset. You proactively seek feedback, ask good questions, and continue building your technical depth.

• Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction.

Base Pay Grade - L

Equity Grade - 5

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).

CAN base pay range per year: CAD $133,000 - $183,000

Location - Remote Canada This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan.

#LI-Remote

Affirm is proud to be a remote-first company! The majority of our roles are remote and you can work almost anywhere within the country of employment. Affirmers in proximal roles have the flexibility to work remotely, but will occasionally be required to work out of their assigned Affirm office. A limited number of roles remain office-based due to the nature of their job responsibilities.

We’re extremely proud to offer competitive benefits that are anchored to our core value of people come first. Some key highlights of our benefits package include:

• Health care coverage - Affirm covers all premiums for all levels of coverage for you and your dependents
• Flexible Spending Wallets - generous stipends for spending on Technology, Food, various Lifestyle needs, and family forming expenses
• Time off - competitive vacation and holiday schedules allowing you to take time off to rest and recharge
• ESPP - An employee stock purchase plan enabling you to buy shares of Affirm at a discount

We believe It’s On Us to provide an inclusive interview experience for all, including people with disabilities. We are happy to provide reasonable accommodations to candidates in need of individualized support during the hiring process.

[For U.S. positions that could be performed in Los Angeles or San Francisco] Pursuant to the San Francisco Fair Chance Ordinance and Los Angeles Fair Chance Initiative for Hiring Ordinance, Affirm will consider for employment qualified applicants with arrest and conviction records.

By clicking “Submit Application,” you acknowledge that you have read Affirm’s Global Candidate Privacy Notice and hereby freely and unambiguously give informed consent to the collection, processing, use, and storage of your personal information as described therein.

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest.

About the InfoSec & IT Team

The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk. We partner closely with product, engineering, infrastructure, risk, compliance, and other teams to identify security risks early, recommend pragmatic mitigations, and help teams find safe paths to launch.

We are looking for an early-career Application Security Engineer who is curious, collaborative, and comfortable working with code. You will help assess application risks, support vulnerability management efforts, partner with engineering teams on secure design decisions, and contribute lightweight tooling, automation, and code-informed analysis that helps AppSec scale across Affirm.

This role is a great fit for someone who has hands-on software or security experience, enjoys reading and reasoning about code, is actively developing offensive security skills, and wants to apply those skills in a product-minded, risk-based way.

What You’ll Do

• Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps.

• Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist.

• Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues.

• Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers.

• Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk.

• Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting.

• Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation.

• Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases.

• Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk.

• Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority.

• Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes.

• Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs.

What We Look For

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.

• Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar.

• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.

• Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking.

• Some hands-on experience building, testing, breaking, or securing software. This could include professional experience, internships, security labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework.

• Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes.

• Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns.

• Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments.

• Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization.

• Ability to reason about risk and tradeoffs, not just identify issues. You can explain what could go wrong, how likely it is, what impact it may have, and what options exist to reduce risk.

• Strong product and engineering empathy. You seek to understand launch goals, technical constraints, user impact, and business priorities before recommending a path forward.

• Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms.

• A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams.

• Curiosity, humility, and a growth mindset. You proactively seek feedback, ask good questions, and continue building your technical depth.

• Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction.

Base Pay Grade - L

Equity Grade - 6

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include equity rewards, monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents.)

USA base pay range (CA, WA, NY, NJ, CT): $165,000 - $225,000

USA base pay range (all other U.S. states): $146,000 - $206,000

#LI-Remote

Affirm is proud to be a remote-first company! The majority of our roles are remote and you can work almost anywhere within the country of employment. Affirmers in proximal roles have the flexibility to work remotely, but will occasionally be required to work out of their assigned Affirm office. A limited number of roles remain office-based due to the nature of their job responsibilities.

We’re extremely proud to offer competitive benefits that are anchored to our core value of people come first. Some key highlights of our benefits package include:

• Health care coverage - Affirm covers all premiums for all levels of coverage for you and your dependents
• Flexible Spending Wallets - generous stipends for spending on Technology, Food, various Lifestyle needs, and family forming expenses
• Time off - competitive vacation and holiday schedules allowing you to take time off to rest and recharge
• ESPP - An employee stock purchase plan enabling you to buy shares of Affirm at a discount

We believe It’s On Us to provide an inclusive interview experience for all, including people with disabilities. We are happy to provide reasonable accommodations to candidates in need of individualized support during the hiring process.

[For U.S. positions that could be performed in Los Angeles or San Francisco] Pursuant to the San Francisco Fair Chance Ordinance and Los Angeles Fair Chance Initiative for Hiring Ordinance, Affirm will consider for employment qualified applicants with arrest and conviction records.

By clicking “Submit Application,” you acknowledge that you have read Affirm’s Global Candidate Privacy Notice and hereby freely and unambiguously give informed consent to the collection, processing, use, and storage of your personal information as described therein.

Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest.

About the InfoSec & IT Team

The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk. We partner closely with product, engineering, infrastructure, risk, compliance, and other teams to identify security risks early, recommend pragmatic mitigations, and help teams find safe paths to launch.

We are looking for an early-career Application Security Engineer who is curious, collaborative, and comfortable working with code. You will help assess application risks, support vulnerability management efforts, partner with engineering teams on secure design decisions, and contribute lightweight tooling, automation, and code-informed analysis that helps AppSec scale across Affirm.

This role is a great fit for someone who has hands-on software or security experience, enjoys reading and reasoning about code, is actively developing offensive security skills, and wants to apply those skills in a product-minded, risk-based way.

What You’ll Do

• Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps.

• Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist.

• Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues.

• Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers.

• Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk.

• Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting.

• Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation.

• Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases.

• Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk.

• Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority.

• Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes.

• Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs.

What We Look For

• 0–2+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience.

• Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar.

• Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases.

• Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking.

• Some hands-on experience building, testing, breaking, or securing software. This could include professional experience, internships, security labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework.

• Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes.

• Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns.

• Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments.

• Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization.

• Ability to reason about risk and tradeoffs, not just identify issues. You can explain what could go wrong, how likely it is, what impact it may have, and what options exist to reduce risk.

• Strong product and engineering empathy. You seek to understand launch goals, technical constraints, user impact, and business priorities before recommending a path forward.

• Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms.

• A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams.

• Curiosity, humility, and a growth mindset. You proactively seek feedback, ask good questions, and continue building your technical depth.

• Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction.

Base Pay Grade - L

Equity Grade - 5

Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills.

Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company).

CAN base pay range per year: CAD $133,000 - $183,000

Location - Remote Canada This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan.

#LI-Remote

Affirm is proud to be a remote-first company! The majority of our roles are remote and you can work almost anywhere within the country of employment. Affirmers in proximal roles have the flexibility to work remotely, but will occasionally be required to work out of their assigned Affirm office. A limited number of roles remain office-based due to the nature of their job responsibilities.

We’re extremely proud to offer competitive benefits that are anchored to our core value of people come first. Some key highlights of our benefits package include:

• Health care coverage - Affirm covers all premiums for all levels of coverage for you and your dependents
• Flexible Spending Wallets - generous stipends for spending on Technology, Food, various Lifestyle needs, and family forming expenses
• Time off - competitive vacation and holiday schedules allowing you to take time off to rest and recharge
• ESPP - An employee stock purchase plan enabling you to buy shares of Affirm at a discount

We believe It’s On Us to provide an inclusive interview experience for all, including people with disabilities. We are happy to provide reasonable accommodations to candidates in need of individualized support during the hiring process.

[For U.S. positions that could be performed in Los Angeles or San Francisco] Pursuant to the San Francisco Fair Chance Ordinance and Los Angeles Fair Chance Initiative for Hiring Ordinance, Affirm will consider for employment qualified applicants with arrest and conviction records.

By clicking “Submit Application,” you acknowledge that you have read Affirm’s Global Candidate Privacy Notice and hereby freely and unambiguously give informed consent to the collection, processing, use, and storage of your personal information as described therein.