About this role
Daily responsibilities center on building endpoint hardening controls across macOS, Windows, Linux, and ChromeOS, designing application authentication and access lifecycles, and running security reviews for SaaS platforms. The team protects the corporate environment where Figure designs and builds general purpose humanoid robots, securing managed devices, identities, collaboration tools, and company data.
As a senior hands-on individual contributor on the Security & Privacy team, the incoming engineer ships controls as code, manages configurations through GitOps, and applies software engineering discipline to corporate infrastructure. The ideal candidate brings deep expertise in either endpoint engineering, identity and access, or application access design, combined with working knowledge of the other domains.
What you will do
- Build and deploy endpoint hardening controls across macOS, Windows, Linux, and ChromeOS using GitOps and FleetDM.
- Tie data access to healthy managed devices and verified users through phishing-resistant factors and posture checks.
- Manage configuration and permissions for AI assistants and coding agents to bring them under enterprise control.
- Design application authentication, role-based access control, and access lifecycles from first principles.
- Conduct security reviews and governance for third-party vendors, SaaS tools, OAuth grants, and connector integrations.
- Build inventories for application discovery, posture management, and grant tracking to feed vulnerability remediation.
- Threat model the corporate attack surface repeatedly and partner with Detection and Response and IT on telemetry and rollouts.
What you need
- Apply software engineering discipline in Python, Bash, PowerShell, or similar languages for internal tooling and integrations.
- Utilize configuration-as-code and CI/CD pipelines for corporate infrastructure management.
- Demonstrate threat-modeling judgment that focuses on significant security problems and drives them to completion.
- Bring at least six years of professional experience in corporate or enterprise security engineering.
- Hold a Bachelor's degree in Computer Science, Engineering, Information Systems, or possess equivalent practical experience.
- Possess deep technical depth in at least one key domain such as endpoint security, identity and access, or application access design, with working knowledge of the remaining areas.
Skills and tech stack
Questions candidates ask
Where is the team located and what is the work policy?
Figure is based in San Jose, CA and requires 5 days per week of in-office collaboration.
What is the salary range for this role?
The US base salary range for this full-time position is between $150,000 and $250,000 annually, with exact pay varying based on individual factors like job-related knowledge, skills, and experience.
What background is expected for this engineering role?
Candidates need 6+ years in corporate or enterprise security engineering alongside a bachelor's degree in a related field or equivalent experience. The team requires deep expertise in one of endpoint security, identity and access, or application access design, plus working knowledge of the others.
How does the security team operate day to day?
Controls are shipped as code, changes are versioned and reviewed, and posture is measured rather than asserted. Engineers use configuration-as-code and CI/CD applied to corporate infrastructure.