Security Engineer - Infrastructure Security

AI Chopping Block; San Jose (CA); Hybrid; USD 150,000 - 250,000; Full time

Job summary

Figure, an AI Robotics company in San Jose, is seeking an Infrastructure Security Engineer to build secure foundations for our backend and infrastructure.

You'll own multi-cloud authn/authz, drive zero-trust networking, and ship security controls as code, while collaborating across DevOps, Networking, and IR teams in a fast-paced, hardware-informed environment.

Qualifications

• Experience and security knowledge of one or more domains and technologies: Kubernetes, containers, service mesh, networking, operating system internals, authentication/authorization protocols, and cloud security tools.
• Experience developing and deploying services in multi-cloud environments, preferably familiar with a multi-cloud infrastructure spanning at least two of Azure, AWS, or Google Cloud Platform.
• 6+ years of security / software development experience.
• Strong software engineering skills (not scripting or automation) in C/C++, Rust, Golang, Python or similar.
• Passion for learning and helping others.
• Excellent verbal and written communication skills, with high attention to detail.
• BS/BA in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field

Responsibilities

• Securely roll out AI tooling across infrastructure, securing deployment paths, service-to-service communication, and network boundaries.
• Collaborate with Networking on data-center and cloud network security: NSGs, segmentation, VPC structure, private connectivity, and egress policy.
• Provide telemetry and context during incidents to enable Detection & Response teams.
• Own multi-cloud authentication and authorization: centralized SSO for human identities, workload identity, and least-privilege access across cloud providers.
• Extend identity model to on-prem and neocloud, including hardware-rooted machine identity across infrastructure.
• Move toward sealed, short-lived, workload-scoped authentication and just-in-time elevated access.
• Measure posture with asset/identity inventory, drift detection, and coverage metrics across environments.
• Turn misconfigurations and findings into tracked remediation across all environments.

Skills

Kubernetes

Containers

Service mesh

Networking

OS internals

Authn/Authz protocols

Cloud security tools

Education

BS/BA in Computer Science or related field

Job description

Figure is an AI Robotics company developing a general purpose humanoid. Our humanoid robot is designed for commercial tasks and the home. We are based in San Jose, CA and require 5 days/week in-office collaboration. It’s time to build.

We're looking for an Infrastructure Security Engineer to join the Security & Privacy team at Figure, focused on designing, implementing, and managing the security controls and frameworks that protect the company's backend services and infrastructure. This includes building strong foundations that let employees move quickly and safely: secure defaults, paved paths, and self-service guardrails.

We are an engineering team. Controls ship as code, changes are versioned and reviewed, and posture is measured rather than asserted. This is a senior, hands-on individual contributor role. Nobody arrives deep in all of it; we want real depth in one of endpoint engineering, identity and access, or application access design, working knowledge of the rest, and room to build depth here. This space is still being built out, so you'll also have latitude to shape the roadmap toward the work you find most interesting.

Responsibilities:

Partner across teams

• Work with the DevOps and Infrastructure teams to securely roll out AI tooling across our infrastructure, securing the deployment path, service-to-service communication, and the network boundaries around these workloads.
• Partner with the Networking team on data-center and cloud network security: NSGs, segmentation, VPC structure, private connectivity, and egress policy.
• Enable the Detection & Response team by making every environment produce the telemetry they need, and provide environment access and context during incidents.

Authentication / Authorization

• Own multi-cloud authentication and authorization: centralized SSO for human identities, workload identity and federated credentials for machine identities, and consistent, least-privilege access policy across cloud providers.
• Extend that identity model to on-prem and neocloud environments, including hardware-rooted machine identity so all our infrastructure inherits the same authN/authZ guarantees as our cloud backends.
• Drive the move away from long-lived reusable credentials toward sealed, short-lived, workload-scoped authentication, and build just-in-time, time-bound elevated access.

Visibility

• Measure posture: build the tooling and pipelines for asset and identity inventory, configuration drift detection, and coverage metrics across cloud, on-prem, and neocloud environments.
• Turn misconfiguration and vulnerability findings into tracked, closed-loop remediation across every environment class.

Networking

• Advance our zero-trust networking model as the universal access layer: identity-aware, posture-gated access to internal services with no public IPs and no cross-environment traffic outside the overlay.
• Design and enforce egress controls so workloads can't make arbitrary outbound calls.
• Define the secure-by-default networking patterns other teams build on top of, so segmentation and access rules are versioned, reviewed, and auditable rather than hand-configured.

Requirements:

• Experience and security knowledge of one or more domains and technologies: Kubernetes, containers, service mesh, networking, operating system internals, authentication/authorization protocols, and cloud security tools.
• Experience developing and deploying services in multi-cloud environments, preferably familiar with a multi-cloud infrastructure spanning at least two of the three: Azure, AWS, or Google Cloud Platform.
• 6+ years of security / software development experience.
• Strong software engineering skills (not scripting or automation) skills in C/C++, Rust, Golang, Python or similar.
• Passion for learning and helping others.
• Excellent verbal and written communication skills, with high attention to detail.
• BS/BA in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field

Bonus Qualifications:

• Familiarity with zero-trust networking, posture-based access control, and egress/segmentation design.
• Hands-on with workload identity / federated credentials, and secrets management.
• Experience with delivering security controls as reviewed, versioned code.
• Familiarity with securing AI/ML tool usage across infrastructure.
• Track record of building self-service security tooling and paved paths that scale to a fast-moving engineering org.
• Experience securing on-prem or neocloud alongside public cloud.

The US base salary range for this full-time position is between $150,000 - $250,000 annually.

The pay offered for this position may vary based on several individual factors, including job-related knowledge, skills, and experience. The total compensation package may also include additional components/benefits depending on the specific role. This information will be shared if an employment offer is extended.