Senior Application Security Engineer, Figment

• Bachelor's degree or five or more years of work experience
• Experience with web application and API exploitation or security assessments
• Experience with web application programming languages such as Javascript/Typescript and Ruby
• Experience with CI/CD workflows and pipelines
• Experience in scripting and automation of simple tasks using Bash, Python, or similar
• Experience developing, extending, or modifying exploits, shellcode or exploit tools
• Experience with container orchestration management tools such as Docker and Kubernetes
• Experience with source code review for control flow and security flaws
• Experience with red, blue, or purple teaming exercises
• Strong knowledge of offensive security and pentesting tooling such as Kali Linux, Burp Suite, and other open source tools
• Strong technical writing

Desirable

• As a senior member of the Figment Security Red Team, your responsibility will be to design and execute campaign-based security testing for Figment
• This will involve targeting multiple types of assets
• Successful applicants should have the ability to evaluate environments, applications, systems, or processes to identify vulnerabilities
• Furthermore, they should be able to translate these findings into practical attack strategies for real-world scenarios
• To effectively support Figment's security initiatives, you will need to utilize your knowledge of modern web applications, cloud platforms, CI/CD pipelines, networking and protocols, databases, middleware applications, and scripting
• You will also need to effectively communicate highly technical information to internal customers
• Additionally, you will be responsible for providing remediation recommendations and validating security remediation findings
• Discover and exploit novel vulnerabilities in Figment applications
• Perform a full range of red team activities focusing on application security, API exploitation, and software deployment pipelines
• Document processes, procedures, and workflows for red team operations
• Develop comprehensive and accurate reports and presentations for both technical and executive audiences
• Collaborate with seniors in the security team and the product team to enhance the company's security posture
• Effectively communicate findings and strategies to stakeholders, including technical staff, executive leadership, and legal counsel
• Provide practical and risk-appropriate recommendations to address vulnerabilities
• Configure and safely use offensive security tools, tactics, and procedures in Figment environments
• Enhance Figment's red teaming processes by developing and improving scripts, infrastructure, tools, and methodologies
• Offer recommendations and guidance to enhance the defensive capabilities of the team and its ability to defend the Figment Enterprise
• Provide mentoring and training to blue team members and actively participate in cross-team security exercises
• Provide technical expertise and support during incident response and assist in creating post-incident action plans
• In addition to collaborating with other Security team members, this role will collaborate most often with our Product Engineering teams

• At Figment, we try to go above and beyond in making sure that you have the best possible experience interviewing with us. We strive for a smooth, organized, and informative process
• During your first Recruiter Call, you will be provided with more information about Figment, the position and what to expect for the rest of the interview process. Please be prepared to discuss why you are interested in joining Figment and what excites you about the position and company
• As we go through the process, we work to make sure that you hear back from us in a timely fashion. If we decide at any point that we’re unfortunately not moving forward, we will give you feedback on why it was not a fit
• We aim for the entire process to take around 2-4 weeks from initial screen to offer. There can be exceptions on either side of the bell curve here, but as a rule, that’s the time-frame you can expect