Senior AppSec Engineer - Lead Secure SDLC

Figure; United States; On-site; USD 112,000 - 168,000; Full time

Benefits offered by this job

Medical, dental, vision

401(k) and commuter benefits

Life and disability insurance

Paid holidays and family leave

Education reimbursement

Job summary

Figure is seeking a Senior Application Security Engineer in the United States to own and scale our application security program. You will partner with Engineering, DevOps, and IT to enforce resilient security practices across the software development lifecycle and drive measurable risk reductions.

You will lead threat modeling, design reviews, and security tooling decisions, mentoring engineers and delivering secure, scalable systems.

Qualifications

• 6–8+ years in application security, product security, or a security‑focused software engineering role.
• Strong coding ability in Go, Python, TypeScript/JavaScript, Java/Kotlin — read unfamiliar code, build tooling, and propose fixes.
• Hands‑on experience building or scaling a vulnerability management program, including triage, prioritization, and remediation workflows.
• Experience integrating security tooling into CI/CD (SAST, DAST, SCA, secrets scanning, IaC scanning).
• Familiarity with software supply‑chain security and dependency vetting (e.g., SCA platforms, Semgrep, Snyk, Socket).
• Deep knowledge of OWASP Top 10, secure coding patterns, and vulnerability classes; able to teach engineers.
• Extensive experience leading threat modeling and security design reviews.
• Strong cross‑functional collaboration and remediation leadership without owning code.
• Leadership in application security initiatives end‑to‑end; able to mentor engineers.
• Ability to communicate risk and tradeoffs clearly to engineers and leadership.
• Expertise in authentication/authorization, cryptography, API security, or cloud‑native security.
• Curiosity and persistence in root-cause analysis and long‑lasting improvements.
• GCP cloud security exposure and blockchain/Web3 security experience are pluses.

Responsibilities

• Own and evolve Figure's vulnerability management program, including triage, prioritization, tracking remediation, and reporting on risk reduction over time.
• Collaborate with DevOps to integrate security gates throughout the software development lifecycle, ensuring automation and repeatability of secure deployments.
• Manage third‑party penetration tests, including scoping, vendor coordination, and remediation tracking.
• Automate routine toil such as patching and dependency upgrades.
• Lead threat modeling, architecture reviews, and security design reviews for new features and services.
• Lead cross‑team initiatives to improve security posture while balancing speed and innovation.
• Define and drive Figure's application security strategy and roadmap, including secure coding standards.
• Mentor engineers and build a security champions program that scales secure development practices.
• Evaluate, select, and own application security tooling and vendors.
• Track program metrics and communicate security risk to engineering and leadership.
• Participate in incident response, on‑call rotations, and post‑incident reviews.
• Leverage AI to augment threat hunting, vulnerability scanning, and triage; build AI agents for testing and analysis.

Skills

Go

Python

TypeScript/JavaScript

Java/Kotlin

Vulnerability management

CI/CD security

Cloud security

Blockchain security

Security leadership

Mentoring engineers

Tools

Semgrep

Snyk

Socket

Job description

Figure is seeking a Senior Application Security Engineer in the United States to own and scale our application security program. You will partner with Engineering, DevOps, and IT to enforce resilient security practices across the software development lifecycle and drive measurable risk reductions.

You will lead threat modeling, design reviews, and security tooling decisions, mentoring engineers and delivering secure, scalable systems.