As a Senior Application Security Engineer at Figure, you will be pivotal in the security of our software from the first line of code through deployment. You’ll own and set the direction for our application security program, build and scale our vulnerability management program, embed secure coding practices into engineering workflows, and help ensure security standards are met at every stage of the software development lifecycle. We’re looking for a collaborative, hands-on senior engineer with a strong background in reading and writing code. You’ll partner closely with Engineering, DevOps, and IT to ensure our security processes are resilient, scalable, and seamlessly integrated into our workflows.

What You’ll Do

• Own and evolve Figure’s vulnerability management program, including triage, prioritization, tracking remediation, and reporting on risk reduction over time.
• Collaborate with DevOps to integrate security gates at various points throughout the software development lifecycle, ensuring automation and repeatability of secure deployments.
• Manage third-party penetration tests, including scoping, vendor coordination, and tracking remediation of findings.
• Automate sources of toil, such as routine patching or dependency upgrades.
• Lead threat modeling, architecture reviews, and security design reviews for new features and services, partnering with engineering teams early in the design process.
• Lead cross-team initiatives that significantly improve our security posture while balancing speed and innovation.
• Define and drive Figure’s application security strategy and roadmap, including secure coding standards and security requirements for new services.
• Mentor engineers across the organization and build a security champions program that scales secure development practices.
• Evaluate, select, and own application security tooling and vendors.
• Track program metrics and communicate application security risk to engineering and executive leadership.
• Actively participate in incident response, on-call rotations, and post-incident reviews to continuously improve defenses.
• Leverage AI to augment threat hunting, vulnerability scanning, and triage, using it to surface signal faster and reduce manual review load.
• Design and build AI agents to perform in-depth testing and analysis of our infrastructure and code.

• 6-8+ years in application security, product security, or a security-focused software engineering role.
• Strong coding ability in one or more languages used in modern web/backend development (e.g., Go, Python, TypeScript/JavaScript, Java/Kotlin) - enough to read unfamiliar code, build tooling and automation, and propose concrete fixes, not just file findings.
• Hands-on experience building or scaling a vulnerability management program, including triage, prioritization, and remediation workflows.
• Experience integrating security tooling into CI/CD (SAST, DAST, SCA, secrets scanning, IaC scanning) and tuning it for signal over noise.
• Familiarity with software supply-chain security and dependency vetting (e.g., SCA platforms, tools like Semgrep, Snyk, Socket, or comparable).
• Deep knowledge of the OWASP Top 10, secure coding patterns, and common vulnerability classes, with the ability to teach them to other engineers.
• Extensive experience leading threat modeling and security design reviews.
• Strong cross-functional collaboration skills and the ability to drive remediation across teams without owning the code yourself.
• Track record of leading application security initiatives end to end, from strategy and roadmap through rollout and measurable results.
• Experience mentoring engineers and acting as a technical leader, including running or growing a security champions program.
• Ability to communicate risk and tradeoffs clearly to both engineers and leadership.
• Deep expertise in at least one area, such as authentication and authorization, cryptography, API security, or cloud-native application security.
• Relentless curiosity and persistence in investigating root causes and driving long-lasting improvements.
• Cloud security exposure (GCP a plus) and prior blockchain/Web3 security experience are pluses, not requirements.
• Familiarity with security and compliance requirements in regulated financial services (e.g., SOC 2, PCI DSS, GLBA) is a plus.
• Hands-on proficiency with AI-assisted security tooling and a practical sense of its strengths and limits.
• Adhere to all company security policies and data handling procedures.
• Complete mandatory security awareness training within required timeframes.
• Promptly report any suspected security incidents or suspicious activity to the Security team.

• Base Compensation Range: $112,320 - $168,480/yr
• 25% annual bonus target, paid quarterly
• Company equity in the form of RSUs

This is the compensation range for the role in the United States. Actual compensation may vary based on a candidate’s experience, skills, location, internal equity, and evolving business needs. While most offers are generally made within the middle of the range, final compensation is determined based on the factors above., * Comprehensive medical, dental, and vision coverage, with 100% employer-paid premiums for employees and their dependents on select plans

• Company HSA, FSA, Dependent Care FSA, 401(k), and commuter benefits
• Employer-paid life and disability insurance
• 11 observed holidays and PTO plan
• Up to 12 weeks of paid family leave
• Continuing education reimbursement

Depending on your residential location certain laws might regulate the way Figure manages applicant data. California Residents, please review our California Employee and General Workforce Privacy Notice for further information. By submitting your application, you are agreeing and acknowledging that you have read and understand the above notice.

Figure will not sponsor work visas for this position. In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire.

LI-RF1 #LI-Remote

Figure is the market leader in real-world asset (RWA) tokenization. The company has received triple-A ratings from S&P and Moody’s on multiple loan securitizations, the first of its kind for blockchain finance.

We’re proud to be recognized as one of Forbes’ Top 50 Fintech Companies and CNBC’s World’s Top Fintech Companies.