Senior Application Security Engineer

Job Description: - Own and evolve Figure's vulnerability management program, including triage, prioritization, remediation tracking, and risk-reduction reporting

• Integrate security gates with DevOps throughout the software development lifecycle
• Manage third-party penetration tests, including scoping, vendor coordination, and remediation tracking
• Automate routine patching and dependency upgrades
• Lead threat modeling, architecture reviews, and security design reviews
• Lead cross-team initiatives to improve the security posture
• Define and drive the application security strategy and roadmap, including secure coding standards and security requirements
• Mentor engineers and build a scalable security champions program
• Evaluate, select, and own application security tooling and vendors
• Track program metrics and communicate application security risk to engineering and executive leadership
• Participate in incident response, on-call rotations, and post-incident reviews
• Use AI for threat hunting, vulnerability scanning, and triage
• Design and build AI agents for infrastructure and code testing and analysis

Requirements: - 6-8+ years in application security, product security, or a security-focused software engineering role

• Strong coding ability in one or more languages used in modern web/backend development (e.g., Go, Python, TypeScript/JavaScript, Java/Kotlin)
• Hands-on experience building or scaling a vulnerability management program, including triage, prioritization, and remediation workflows
• Experience integrating security tooling into CI/CD (SAST, DAST, SCA, secrets scanning, IaC scanning) and tuning it for signal over noise
• Familiarity with software supply-chain security and dependency vetting (e.g., SCA platforms, Semgrep, Snyk, Socket, or comparable)
• Deep knowledge of the OWASP Top 10, secure coding patterns, and common vulnerability classes
• Extensive experience leading threat modeling and security design reviews
• Strong cross-functional collaboration skills and ability to drive remediation across teams
• Track record of leading application security initiatives end to end
• Experience mentoring engineers and running or growing a security champions program
• Ability to communicate risk and tradeoffs clearly to engineers and leadership
• Deep expertise in at least one area such as authentication and authorization, cryptography, API security, or cloud-native application security
• Hands-on proficiency with AI-assisted security tooling
• Adhere to company security policies and data handling procedures
• Complete mandatory security awareness training within required timeframes
• Promptly report suspected security incidents or suspicious activity
• Cloud security exposure and prior blockchain/Web3 security experience are pluses, not requirements
• Familiarity with SOC 2, PCI DSS, or GLBA is a plus
• Must verify identity and eligibility to work in the United States
• Figure will not sponsor work visas for this position

Benefits: - 25% annual bonus target, paid quarterly

• Company equity in the form of RSUs
• Comprehensive medical, dental, and vision coverage, with 100% employer-paid premiums for employees and their dependents on select plans
• Company HSA, FSA, Dependent Care FSA, 401(k), and commuter benefits
• Employer-paid life and disability insurance
• 11 observed holidays and PTO plan
• Up to 12 weeks of paid family leave
• Continuing education reimbursement