Senior Application Security Engineer

Figure

. Own and evolve Figure's vulnerability management program, including triage, prioritization, remediation tracking, and risk-reduction reporting .

Posted 10/28/2026full-timeRemote • United StatesSenior💰 $112,320 - $168,480 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in application security, including vulnerability management, secure coding practices, and threat modeling. Proficient in integrating security tooling within CI/CD pipelines and mentoring engineering teams to enhance security posture.

Highest-signal resume keywords

Application Security StrategyVulnerability Management ProgramSecure Coding StandardsThreat ModelingAI-Assisted Security Tooling

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

GoPythonTypeScriptJavaVulnerability TriageRemediation TrackingSASTDASTOWASP Top 10Cloud-Native Application Security

Soft Skills

Cross-Functional CollaborationMentoringCommunication

Tools & Technologies

SCA PlatformsSemgrepSnykSocketCI/CD Integration

Industry Keywords

SOC 2PCI DSSGLBASecurity Awareness TrainingIncident Response

Tech Stack

Tools & technologies

CloudJavaJavaScriptKotlinPythonTypeScriptWeb3Go

About the role

Key responsibilities & impact

Own and evolve Figure's vulnerability management program, including triage, prioritization, remediation tracking, and risk-reduction reporting
Integrate security gates with DevOps throughout the software development lifecycle
Manage third-party penetration tests, including scoping, vendor coordination, and remediation tracking
Automate routine patching and dependency upgrades
Lead threat modeling, architecture reviews, and security design reviews
Lead cross-team initiatives to improve the security posture
Define and drive the application security strategy and roadmap, including secure coding standards and security requirements
Mentor engineers and build a scalable security champions program
Evaluate, select, and own application security tooling and vendors
Track program metrics and communicate application security risk to engineering and executive leadership
Participate in incident response, on-call rotations, and post-incident reviews
Use AI for threat hunting, vulnerability scanning, and triage
Design and build AI agents for infrastructure and code testing and analysis

Requirements

What you’ll need

6-8+ years in application security, product security, or a security-focused software engineering role
Strong coding ability in one or more languages used in modern web/backend development (e.g., Go, Python, TypeScript/JavaScript, Java/Kotlin)
Hands-on experience building or scaling a vulnerability management program, including triage, prioritization, and remediation workflows
Experience integrating security tooling into CI/CD (SAST, DAST, SCA, secrets scanning, IaC scanning) and tuning it for signal over noise
Familiarity with software supply-chain security and dependency vetting (e.g., SCA platforms, Semgrep, Snyk, Socket, or comparable)
Deep knowledge of the OWASP Top 10, secure coding patterns, and common vulnerability classes
Extensive experience leading threat modeling and security design reviews
Strong cross-functional collaboration skills and ability to drive remediation across teams
Track record of leading application security initiatives end to end
Experience mentoring engineers and running or growing a security champions program
Ability to communicate risk and tradeoffs clearly to engineers and leadership
Deep expertise in at least one area such as authentication and authorization, cryptography, API security, or cloud-native application security
Hands-on proficiency with AI-assisted security tooling
Adhere to company security policies and data handling procedures
Complete mandatory security awareness training within required timeframes
Promptly report suspected security incidents or suspicious activity
Cloud security exposure and prior blockchain/Web3 security experience are pluses, not requirements
Familiarity with SOC 2, PCI DSS, or GLBA is a plus
Must verify identity and eligibility to work in the United States
Figure will not sponsor work visas for this position

Benefits

Comp & perks

25% annual bonus target, paid quarterly
Company equity in the form of RSUs
Comprehensive medical, dental, and vision coverage, with 100% employer-paid premiums for employees and their dependents on select plans
Company HSA, FSA, Dependent Care FSA, 401(k), and commuter benefits
Employer-paid life and disability insurance
11 observed holidays and PTO plan
Up to 12 weeks of paid family leave
Continuing education reimbursement