Application Security Engineer

Figure (NASDAQ: FIGR) is transforming capital markets through blockchain. We’re proving that blockchain isn’t just theory - it’s powering real products used by hundreds of thousands of consumers and institutions. 

By combining blockchain’s transparency and efficiency with AI-driven automation, we’ve reimagined how loans are originated, funded, and traded in secondary markets. From faster processing times to lower costs and reduced bias, our technology is helping borrowers, investors, and financial institutions achieve better outcomes.

Together with our 170+ partners, we’ve originated over $22 billion in home equity loans (HELOCs) on our blockchain-native platform, making Figure the largest non-bank provider of home equity financing in the U.S. Figure’s ecosystem also includes YLDS, an SEC-registered yield-bearing stablecoin that operates as a tokenized money market fund, and several other products and platforms that are reshaping consumer finance and capital markets. 

We’re proud to be recognized as one of Forbes’ Most Innovative Fintech Startups in 2025 and Fast Company’s Most Innovative Companies in Finance and Personal Finance.

As an Application Security Engineer at Figure, you will be pivotal in the security of our software from the first line of code through deployment. You'll build and scale our vulnerability management program, embed secure coding practices into engineering workflows, and help ensure security standards are met at every stage of the software development lifecycle. We’re looking for a collaborative, hands-on engineer with a strong background in reading and writing code. You’ll partner closely with Engineering, DevOps, and IT to ensure our security processes are resilient, scalable, and seamlessly integrated into our workflows.

• →Architect, design, and implement end-to-end security solutions, including firewalls, intrusion detection, encryption protocols, security event management, and cloud security controls.
• →Collaborate with DevOps to integrate security into CI/CD pipelines, ensuring automation and repeatability of secure deployments.
• →Conduct regular security assessments, threat modeling, and architecture reviews to identify risks and design mitigations.
• →Lead cross-team initiatives that significantly improve our security posture while balancing speed and innovation.
• →Mentor engineers on security best practices and build a culture of security by design.
• →Actively participate in incident response, on-call rotations, and post-incident reviews to continuously improve defenses.

• Improve and run Figure's vulnerability management program including triage, prioritization, tracking remediation, and reporting on risk reduction over time.
• Collaborate with DevOps to integrate security gates at various points throughout the software development lifecycle, ensuring automation and repeatability of secure deployments.
• Manage third-party penetration tests, including scoping, vendor coordination, and tracking remediation of findings.
• Automate sources of toil, such as routine patching or dependency upgrades.
• Conduct threat modeling and security reviews for new features and services, partnering with engineering teams early in the design process.
• Conduct regular security assessments, threat modeling, and architecture reviews to identify risks and design mitigations.
• Lead cross-team initiatives that significantly improve our security posture while balancing speed and innovation.
• Actively participate in incident response, on-call rotations, and post-incident reviews to continuously improve defenses.
• Adhere to all company security policies and data handling procedures.
• Complete mandatory security awareness training within required timeframes.
• Promptly report any suspected security incidents or suspicious activity to the Security team.

• Base Compensation Range: $120,000-$154,440/yr
• 25% annual bonus target, paid quarterly 
• Company equity in the form of RSUs

This is the compensation range for the role in the United States. Actual compensation may vary based on a candidate’s experience, skills, location, internal equity, and evolving business needs. While most offers are generally made within the middle of the range, final compensation is determined based on the factors above.