Senior Application Security Engineer

Figure; United States; On-site; USD 112,000 - 168,000; Full time

Benefits offered by this job

Medical, dental, vision

401(k) and commuter benefits

Life and disability insurance

Paid holidays and family leave

Education reimbursement

Job summary

Figure is seeking a Senior Application Security Engineer in the United States to own and scale our application security program. You will partner with Engineering, DevOps, and IT to enforce resilient security practices across the software development lifecycle and drive measurable risk reductions.

You will lead threat modeling, design reviews, and security tooling decisions, mentoring engineers and delivering secure, scalable systems.

Qualifications

• 6–8+ years in application security, product security, or a security‑focused software engineering role.
• Strong coding ability in Go, Python, TypeScript/JavaScript, Java/Kotlin — read unfamiliar code, build tooling, and propose fixes.
• Hands‑on experience building or scaling a vulnerability management program, including triage, prioritization, and remediation workflows.
• Experience integrating security tooling into CI/CD (SAST, DAST, SCA, secrets scanning, IaC scanning).
• Familiarity with software supply‑chain security and dependency vetting (e.g., SCA platforms, Semgrep, Snyk, Socket).
• Deep knowledge of OWASP Top 10, secure coding patterns, and vulnerability classes; able to teach engineers.
• Extensive experience leading threat modeling and security design reviews.
• Strong cross‑functional collaboration and remediation leadership without owning code.
• Leadership in application security initiatives end‑to‑end; able to mentor engineers.
• Ability to communicate risk and tradeoffs clearly to engineers and leadership.
• Expertise in authentication/authorization, cryptography, API security, or cloud‑native security.
• Curiosity and persistence in root-cause analysis and long‑lasting improvements.
• GCP cloud security exposure and blockchain/Web3 security experience are pluses.

Responsibilities

• Own and evolve Figure's vulnerability management program, including triage, prioritization, tracking remediation, and reporting on risk reduction over time.
• Collaborate with DevOps to integrate security gates throughout the software development lifecycle, ensuring automation and repeatability of secure deployments.
• Manage third‑party penetration tests, including scoping, vendor coordination, and remediation tracking.
• Automate routine toil such as patching and dependency upgrades.
• Lead threat modeling, architecture reviews, and security design reviews for new features and services.
• Lead cross‑team initiatives to improve security posture while balancing speed and innovation.
• Define and drive Figure's application security strategy and roadmap, including secure coding standards.
• Mentor engineers and build a security champions program that scales secure development practices.
• Evaluate, select, and own application security tooling and vendors.
• Track program metrics and communicate security risk to engineering and leadership.
• Participate in incident response, on‑call rotations, and post‑incident reviews.
• Leverage AI to augment threat hunting, vulnerability scanning, and triage; build AI agents for testing and analysis.

Skills

Go

Python

TypeScript/JavaScript

Java/Kotlin

Vulnerability management

CI/CD security

Cloud security

Blockchain security

Security leadership

Mentoring engineers

Tools

Semgrep

Snyk

Socket

Job description

About Figure

Figure Technology Solutions, Inc. (Nasdaq: FIGR; OPEN: FGRS) is the leading blockchain-native capital marketplace for the origination, funding, sale, and trading of tokenized assets. More than 480 partners use its loan origination system and capital marketplace. Collectively, Figure and its partners have originated over $30 billion of loans to date, among other products. The fastest growing components are Figure Connect, its credit marketplace, and Democratized Prime, Figure’s on-chain lend-borrow marketplace. Figure’s ecosystem also includes DART (Digital Asset Registry Technology) for asset custody and lien perfection, and $YLDS, a yield-bearing stablecoin registered with the SEC as a security under the Securities Act of 1933.

About Figure

Figure Technology Solutions, Inc. (Nasdaq: FIGR; OPEN: FGRS) is the leading blockchain-native capital marketplace for the origination, funding, sale, and trading of tokenized assets. More than 480 partners use its loan origination system and capital marketplace. Collectively, Figure and its partners have originated over $30 billion of loans to date, among other products. The fastest growing components are Figure Connect, its credit marketplace, and Democratized Prime, Figure’s on-chain lend-borrow marketplace. Figure’s ecosystem also includes DART (Digital Asset Registry Technology) for asset custody and lien perfection, and $YLDS, a yield-bearing stablecoin registered with the SEC as a security under the Securities Act of 1933. Figure is the market leader in real-world asset (RWA) tokenization. The company has received triple‑A ratings from S&P and Moody’s on multiple loan securitizations, the first of its kind for blockchain finance. We’re proud to be recognized as one of Forbes’ Top 50 Fintech Companies and CNBC’s World’s Top Fintech Companies.

About The Role

As a Senior Application Security Engineer at Figure, you will be pivotal in the security of our software from the first line of code through deployment. You'll own and set the direction for our application security program, build and scale our vulnerability management program, embed secure coding practices into engineering workflows, and help ensure security standards are met at every stage of the software development lifecycle. We’re looking for a collaborative, hands‑on senior engineer with a strong background in reading and writing code. You’ll partner closely with Engineering, DevOps, and IT to ensure our security processes are resilient, scalable, and seamlessly integrated into our workflows.

What You’ll Do

• Own and evolve Figure's vulnerability management program, including triage, prioritization, tracking remediation, and reporting on risk reduction over time.
• Collaborate with DevOps to integrate security gates at various points throughout the software development lifecycle, ensuring automation and repeatability of secure deployments.
• Manage third‑party penetration tests, including scoping, vendor coordination, and tracking remediation of findings.
• Automate sources of toil, such as routine patching or dependency upgrades.
• Lead threat modeling, architecture reviews, and security design reviews for new features and services, partnering with engineering teams early in the design process.
• Lead cross‑team initiatives that significantly improve our security posture while balancing speed and innovation.
• Define and drive Figure's application security strategy and roadmap, including secure coding standards and security requirements for new services.
• Mentor engineers across the organization and build a security champions program that scales secure development practices.
• Evaluate, select, and own application security tooling and vendors.
• Track program metrics and communicate application security risk to engineering and executive leadership.
• Actively participate in incident response, on‑call rotations, and post‑incident reviews to continuously improve defenses.
• Leverage AI to augment threat hunting, vulnerability scanning, and triage, using it to surface signal faster and reduce manual review load.
• Design and build AI agents to perform in‑depth testing and analysis of our infrastructure and code.

What We Look For

• 6-8+ years in application security, product security, or a security‑focused software engineering role.
• Strong coding ability in one or more languages used in modern web/backend development (e.g., Go, Python, TypeScript/JavaScript, Java/Kotlin) — enough to read unfamiliar code, build tooling and automation, and propose concrete fixes, not just file findings.
• Hands‑on experience building or scaling a vulnerability management program, including triage, prioritization, and remediation workflows.
• Experience integrating security tooling into CI/CD (SAST, DAST, SCA, secrets scanning, IaC scanning) and tuning it for signal over noise.
• Familiarity with software supply‑chain security and dependency vetting (e.g., SCA platforms, tools like Semgrep, Snyk, Socket, or comparable).
• Deep knowledge of the OWASP Top 10, secure coding patterns, and common vulnerability classes, with the ability to teach them to other engineers.
• Extensive experience leading threat modeling and security design reviews.
• Strong cross‑functional collaboration skills and the ability to drive remediation across teams without owning the code yourself.
• Track record of leading application security initiatives end to end, from strategy and roadmap through rollout and measurable results.
• Experience mentoring engineers and acting as a technical leader, including running or growing a security champions program.
• Ability to communicate risk and tradeoffs clearly to both engineers and leadership.
• Deep expertise in at least one area, such as authentication and authorization, cryptography, API security, or cloud‑native application security.
• Relentless curiosity and persistence in investigating root causes and driving long‑lasting improvements.
• Cloud security exposure (GCP a plus) and prior blockchain/Web3 security experience are pluses, not requirements.
• Familiarity with security and compliance requirements in regulated financial services (e.g., SOC 2, PCI DSS, GLBA) is a plus.
• Hands‑on proficiency with AI‑assisted security tooling and a practical sense of its strengths and limits.
• Adhere to all company security policies and data handling procedures.
• Complete mandatory security awareness training within required timeframes.
• Promptly report any suspected security incidents or suspicious activity to the Security team.

Salary

• Base Compensation Range: $112,320 - $168,480/yr
• 25% annual bonus target, paid quarterly
• Company equity in the form of RSUs

This is the compensation range for the role in the United States. Actual compensation may vary based on a candidate’s experience, skills, location, internal equity, and evolving business needs. While most offers are generally made within the middle of the range, final compensation is determined based on the factors above.

Benefits

• Comprehensive medical, dental, and vision coverage, with 100% employer‑paid premiums for employees and their dependents on select plans
• Company HSA, FSA, Dependent Care FSA, 401(k), and commuter benefits
• Employer‑paid life and disability insurance
• 11 observed holidays and PTO plan
• Up to 12 weeks of paid family leave
• Continuing education reimbursement

Depending on your residential location certain laws might regulate the way Figure manages applicant data. California Residents, please review our California Employee and General Workforce Privacy Notice for further information. By submitting your application, you are agreeing and acknowledging that you have read and understand the above notice. Figure will not sponsor work visas for this position. In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire.