> Markdown version of [/jobs/ext/4002602-senior-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4002602-senior-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Application Security Engineer - **Company:** Figure Lending - **Location:** San Francisco, CA, United States (Remote available) - **Experience:** Expert - **Salary:** $112,320.0 - $168,480.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), JavaScript (Programming Language), Artificial Intelligence, Software System Penetration Testing, User Authentication, Cloud Computing Security, Continuous Integration, DevOps, Python (Programming Language), Open Web Application Security, PCI Data Security Standards, Blockchain, Secure Coding, Software Engineering, TypeScript, Software Vulnerability Management, Data Processing, Software Security, Backend, Agentic-AI, Kotlin, Build Management, Cybercrime, Web3.js, Static Application Security Testing, Vulnerability Analysis, Golang, Dynamic Application Security Testing - **Published:** October 29, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=19a6e943a0b4e6ae ## About the Role * 6-8+ years in application security, product security, or a security-focused software engineering role. * Strong coding ability in one or more languages used in modern web/backend development (e.g., Go, Python, TypeScript/JavaScript, Java/Kotlin) - enough to read unfamiliar code, build tooling and automation, and propose concrete fixes, not just file findings. * Hands-on experience building or scaling a vulnerability management program, including triage, prioritization, and remediation workflows. * Experience integrating security tooling into CI/CD (SAST, DAST, SCA, secrets scanning, IaC scanning) and tuning it for signal over noise. * Familiarity with software supply-chain security and dependency vetting (e.g., SCA platforms, tools like Semgrep, Snyk, Socket, or comparable). * Deep knowledge of the OWASP Top 10, secure coding patterns, and common vulnerability classes, with the ability to teach them to other engineers. * Extensive experience leading threat modeling and security design reviews. * Strong cross-functional collaboration skills and the ability to drive remediation across teams without owning the code yourself. * Track record of leading application security initiatives end to end, from strategy and roadmap through rollout and measurable results. * Experience mentoring engineers and acting as a technical leader, including running or growing a security champions program. * Ability to communicate risk and tradeoffs clearly to both engineers and leadership. * Deep expertise in at least one area, such as authentication and authorization, cryptography, API security, or cloud-native application security. * Relentless curiosity and persistence in investigating root causes and driving long-lasting improvements. * Cloud security exposure (GCP a plus) and prior blockchain/Web3 security experience are pluses, not requirements. * Familiarity with security and compliance requirements in regulated financial services (e.g., SOC 2, PCI DSS, GLBA) is a plus. * Hands-on proficiency with AI-assisted security tooling and a practical sense of its strengths and limits. * Adhere to all company security policies and data handling procedures. * Complete mandatory security awareness training within required timeframes. * Promptly report any suspected security incidents or suspicious activity to the Security team. ## Description As a Senior Application Security Engineer at Figure, you will be pivotal in the security of our software from the first line of code through deployment. You'll own and set the direction for our application security program, build and scale our vulnerability management program, embed secure coding practices into engineering workflows, and help ensure security standards are met at every stage of the software development lifecycle. We're looking for a collaborative, hands-on senior engineer with a strong background in reading and writing code. You'll partner closely with Engineering, DevOps, and IT to ensure our security processes are resilient, scalable, and seamlessly integrated into our workflows. What You'll Do * Own and evolve Figure's vulnerability management program, including triage, prioritization, tracking remediation, and reporting on risk reduction over time. * Collaborate with DevOps to integrate security gates at various points throughout the software development lifecycle, ensuring automation and repeatability of secure deployments. * Manage third-party penetration tests, including scoping, vendor coordination, and tracking remediation of findings. * Automate sources of toil, such as routine patching or dependency upgrades. * Lead threat modeling, architecture reviews, and security design reviews for new features and services, partnering with engineering teams early in the design process. * Lead cross-team initiatives that significantly improve our security posture while balancing speed and innovation. * Define and drive Figure's application security strategy and roadmap, including secure coding standards and security requirements for new services. * Mentor engineers across the organization and build a security champions program that scales secure development practices. * Evaluate, select, and own application security tooling and vendors. * Track program metrics and communicate application security risk to engineering and executive leadership. * Actively participate in incident response, on-call rotations, and post-incident reviews to continuously improve defenses. * Leverage AI to augment threat hunting, vulnerability scanning, and triage, using it to surface signal faster and reduce manual review load. * Design and build AI agents to perform in-depth testing and analysis of our infrastructure and code.