Security Engineer, Enterprise Security at Figure in San Jose, CA

Job description

• Figure is an AI Robotics company developing a general purpose humanoid. Our humanoid robot is designed for commercial tasks and the home. We are based in San Jose, CA and require 5 days/week in-office collaboration. It's time to build!
• We are an engineering team. Controls ship as code, changes are versioned and reviewed, and posture is measured rather than asserted. This is a senior, hands-on individual contributor role. Nobody arrives deep in all of it; we want real depth in one of endpoint engineering, identity and access, or application access design, working knowledge of the rest, and room to build depth here.

Responsibilities

• Endpoints and access
• Build the endpoint hardening controls across macOS, Windows, Linux, and ChromeOS. Our fleet runs on FleetDM, an osquery-based MDM managed through GitOps: you author the control, you write the query proving it landed, and you ship both in a merge request for review.
• Bind data access to a healthy managed device and the person it was issued to: phishing-resistant factors, session lifetimes, and device posture checks.
• Bring AI assistants and coding agents under enterprise management: configuration and permissions delivered and verified like any other endpoint control.
• Applications and third parties
• Design application authentication, RBAC, and access lifecycle from first principles: identify what an application exposes, threat model it, propose control requirements, and guide owners to implement them.
• Contribute what each engagement teaches to the team's default deployment playbooks: authentication, logging, and network placement.
• Run security review and governance for SaaS and third parties: vendor assessments, OAuth grants, connector integrations, browser extensions, and data movement through the browser.
• Visibility and measurement
• Build the inventories this work depends on: application discovery, application posture management, grant tracking. Feed vulnerability management and build the controls that close what it finds.
• Threat model the corporate attack surface as a repeatable practice and feed the results into what the team works on next. Partner with Detection and Response on telemetry and with IT on rollout.
• Use AI where it earns its place: prepping access reviews, first-pass triage, and analysis that gets a human to a decision faster.

Requirements

• Software engineering discipline in Python, Bash, PowerShell, or similar: integrations and internal tooling as normal work
• Configuration-as-code and CI/CD applied to corporate infrastructure
• Threat-modeling judgment that separates the problems worth solving from the ones existing controls already cover, and drives the former to completion
• 6+ years in corporate or enterprise security engineering
• Bachelor's in Computer Science, Engineering, or Information Systems, or equivalent experience
• Depth required in at least one of the below, knowledge of the others
• Endpoint security on at least two of macOS, Windows, Linux, and ChromeOS: MDM profile engineering, application allowlisting, endpoint security frameworks, and the OS internals behind them. Preferred: fleet-wide osquery telemetry, certificate-based device identity in production, a phased enforcement change shipped with a recovery plan, and devices that live off the corporate network.
• Identity and access: IAM, SaaS security, and zero trust from fundamentals rather than vendor docs, and being able to explain a SAML, OIDC, or SCIM integration for a developer who has never built one. Preferred: mTLS, 802.1X, SSH certificate authorities, and DKIM, DMARC, and SPF in production.
• Application access design: threat modeling what an application exposes, specifying authentication and authorization for the team building it, and designing the provisioning and revocation behind it. Preferred: securing agentic or LLM-integrated systems, including permission models, credential isolation, and egress control.

Skills

Required

• Threat-modeling judgment
• MDM profile engineering
• Application allowlisting
• Endpoint security frameworks
• OS internals
• IAM
• SaaS security
• Zero trust
• SAML, OIDC, or SCIM integration
• Threat modeling applications
• Authentication and authorization design
• Provisioning and revocation design

Preferred

• Fleet-wide osquery telemetry
• mTLS
• 802.1X
• SSH certificate authorities
• DKIM, DMARC, and SPF in production
• Permission models
• Credential isolation
• Egress control

Benefits

• The US base salary range for this full-time position is between $150,000 - $250,000 annually.
• The pay offered for this position may vary based on several individual factors, including job-related knowledge, skills, and experience. The total compensation package may also include additional components/benefits depending on the specific role. This information will be shared if an employment offer is extended.