Staff Security Engineer, Enterprise AI

Remote US

Apply on Affirm's site →

At a Glance

AWSPythonKubernetesTerraformOWASPSOC 2

Full details on LinkedIn

The complete job description, requirements, and application details are available on the original posting.

About Affirm

Industry

financial services

Employees

2,400

935 engineers

Security at Affirm

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

Security Philosophy

Section 1 — Philosophy and priorities.
The Application Security team positions itself as a product-enabling partner focused on trust, compliance, and business-risk reduction — "The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk." (Product Security Engineer II job posting, LinkedIn) Developer-first and pragmatic stance — "We partner closely with product, engineering, infrastructure, risk, compliance, and other teams to identify security risks early, recommend pragmatic mitigations, and help teams find safe paths to launch." (Product Security Engineer II job posting, LinkedIn) Risk-based prioritization rather than severity-only gating — "partner with teams to prioritize and remediate issues based on real-world risk." (Product Security Engineer II job posting, LinkedIn) Primary stated goals include scaling AppSec through lightweight automation, code-informed analysis, reusable guidance, and developer-facing documentation — "Contribute lightweight tooling, automation, and code-informed analysis that helps AppSec scale across Affirm." (Product Security Engineer II job posting, LinkedIn) Public security materials emphasize continuous developer review and protection of customer-facing applications — "Our developers continuously work to improve our code and review it for flaws, and we use web application firewalls to stop potential attacks online." (Affirm Trust Center).

Security Team

Section 2 — People and structure. Org model: Public evidence indicates a dedicated, centralized Application Security function that partners closely with product, engineering, infrastructure, risk, compliance, and other teams; the available posting does not establish whether engineers are permanently embedded. (Product Security Engineer II job posting, LinkedIn) Leader 1: Jeera Lert — Staff Security Engineer; LinkedIn: https://www.linkedin.com/in/jeeralert. Public profile states, "I lead the Red Team program at Affirm" and describes work spanning application, cloud, infrastructure, identity, and offensive security. (LinkedIn, accessed) Leader 2: Jared Stewart — Staff Security Engineer focused on enterprise security, SaaS security, identity, cloud security, and security automation; LinkedIn URL not identified in the available results. (SAINTCON 26 speakers page, accessed) Team size estimate: Search query used: "Affirm application security team LinkedIn". A reliable AppSec-specific employee count was not publicly available; result range: no defensible estimate. The available evidence identifies individual security engineers and a dedicated AppSec job opening but does not establish total team size. Active AppSec job postings: 1 clearly identified public posting — Product Security Engineer II. (LinkedIn Jobs; updated) Common skill and workflow patterns: application-risk assessment; secure design review; code and system-flow analysis; vulnerability triage, validation, severity assessment, remediation guidance, tracking, and reporting; collaboration with engineering; lightweight tooling and automation; secure coding guidance; reusable review patterns; and developer-facing documentation. (Product Security Engineer II job posting, LinkedIn) Common source pattern for findings: internal testing, bug bounty reports, security tooling, penetration tests, and other sources. (Product Security Engineer II job posting, LinkedIn)

Key Initiatives

Section 3 — Programs and workflows. Security Champions program Found/not found: No public evidence of a formal Security Champions program in the available results. Related security-culture activity: Jeera Lert’s public profile says he created and leads "Red Team Rundown," a voluntary technical series for approximately 900 engineers. (LinkedIn, accessed) Shift-left in CI/CD Public evidence supports early risk identification and code-informed analysis, but no specific public details were found for pre-commit hooks, IDE plugins, mandatory pipeline gates, or named CI/CD integrations. (Product Security Engineer II job posting, LinkedIn) Vulnerability management Intake sources: internal testing, bug bounty reports, security tooling, penetration tests, and other sources. (Product Security Engineer II job posting, LinkedIn) Workflow: triage, validation, severity assessment, remediation guidance, tracking, and reporting, with prioritization based on real-world risk. (Product Security Engineer II job posting, LinkedIn) Secure SDLC ceremonies Publicly described activities include secure design decisions, examination of system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases. (Product Security Engineer II job posting, LinkedIn) New programs or tool rollouts in the last 6 months A public May 2026 session described Affirm’s lean cloud SecOps program with AWS and Expel, including onboarding AWS accounts, GuardDuty and CloudTrail coverage, 15-plus integrations, automation, and human handoffs; this is security-operations rather than AppSec-specific. (Expel LinkedIn post) A public profile states that Jeera Lert built an agentic security-testing platform using Python, FastAPI, Playwright, and security tooling to automate end-to-end application assessments while retaining human control over dangerous actions; the timing and production status are not independently established. (LinkedIn, accessed)

Preparing for an AppSec interview?

Get the weekly briefing 2,000+ security pros trust.

Interested in this role?

Apply on Affirm's site