Security Engineer, Figure
Enterprise Security
$150-250k
Office located in San Jose, CA
AI robotics company
Be an early applicant
AI robotics company
501-1000 employees
Be an early applicant
$150-250k
Office located in San Jose, CA
501-1000 employees
Company mission
To expand human capabilities through advanced AI.
Role
Who you are
- Software engineering discipline in Python, Bash, PowerShell, or similar: integrations and internal tooling as normal work
- Configuration-as-code and CI/CD applied to corporate infrastructure
- Threat-modeling judgment that separates the problems worth solving from the ones existing controls already cover, and drives the former to completion
- 6+ years in corporate or enterprise security engineering
- Bachelor's in Computer Science, Engineering, or Information Systems, or equivalent experience
- Depth required in at least one of the below, knowledge of the others:
- Endpoint security on at least two of macOS, Windows, Linux, and ChromeOS: MDM profile engineering, application allowlisting, endpoint security frameworks, and the OS internals behind them. Preferred: fleet-wide osquery telemetry, certificate-based device identity in production, a phased enforcement change shipped with a recovery plan, and devices that live off the corporate network
- Identity and access: IAM, SaaS security, and zero trust from fundamentals rather than vendor docs, and being able to explain a SAML, OIDC, or SCIM integration for a developer who has never built one. Preferred: mTLS, 802.1X, SSH certificate authorities, and DKIM, DMARC, and SPF in production
- Application access design: threat modeling what an application exposes, specifying authentication and authorization for the team building it, and designing the provisioning and revocation behind it. Preferred: securing agentic or LLM-integrated systems, including permission models, credential isolation, and egress control
What the job involves
- We are looking for a Corporate Security Engineer to join the Security & Privacy team at Figure. Corporate Security owns the environment Figure's people work in: computers, identities, collaboration tools, and the company data flowing through all of it. The design and software behind our humanoid sit inside that environment. We keep access to managed devices, make them hard to compromise, and right-size what each can reach, without getting in the way of the people using them
- We are an engineering team. Controls ship as code, changes are versioned and reviewed, and posture is measured rather than asserted. This is a senior, hands-on individual contributor role. Nobody arrives deep in all of it; we want real depth in one of endpoint engineering, identity and access, or application access design, working knowledge of the rest, and room to build depth here
- Build the endpoint hardening controls across macOS, Windows, Linux, and ChromeOS. Our fleet runs on FleetDM, an osquery-based MDM managed through GitOps: you author the control, you write the query proving it landed, and you ship both in a merge request for review
- Bind data access to a healthy managed device and the person it was issued to: phishing-resistant factors, session lifetimes, and device posture checks
- Bring AI assistants and coding agents under enterprise management: configuration and permissions delivered and verified like any other endpoint control
- Design application authentication, RBAC, and access lifecycle from first principles: identify what an application exposes, threat model it, propose control requirements, and guide owners to implement them
- Contribute what each engagement teaches to the team's default deployment playbooks: authentication, logging, and network placement
- Run security review and governance for SaaS and third parties: vendor assessments, OAuth grants, connector integrations, browser extensions, and data movement through the browser
- Build the inventories this work depends on: application discovery, application posture management, grant tracking. Feed vulnerability management and build the controls that close what it finds
- Threat model the corporate attack surface as a repeatable practice and feed the results into what the team works on next. Partner with Detection and Response on telemetry and with IT on rollout
- Use AI where it earns its place: prepping access reviews, first-pass triage, and analysis that gets a human to a decision faster
Our take
Humanoid robots are quickly moving from sci-fi to reality, with big tech companies racing to bring them into workplaces, and soon, our homes. It's a booming market, and Figure is one of the big names in the game.
Figure builds human-like robots that are powered by advanced AI that can walk, see and even understand natural language. Its latest model, the Figure 02, is piloting in a BMW factory, and its in-house AI system, Helix lets these robots perform complex tasks from simple voice prompts.
Interestingly, in 2025 the company severed a previous relationship with OpenAI, claiming a major breakthrough in robot intelligence. This means Figure is now working completely solo, but this hasn't slowed it down. It has secured some major commercial deals and an impressive valuation, and is certainly one to keep a close eye on as it develops.
Freddie
Company Specialist at Welcome to the Jungle
Company
Funding (last 2 of 5 rounds)
Sep 2025
$1bn
SERIES C
Feb 2024
$675m
SERIES B
Total funding: $1.9bn
Company HQ
Sunnyvale, CA
Leadership
Brett Adcock
(Founder)Currently Founder at Archer. Previously Founder at Vettery and various other statups.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 31 more jobs at Figure