Senior Application Security Engineer

Job not on LinkedIn

🔥 0 minutes ago

🇺🇸 United States – Remote

💵 $112.3k - $168.5k / year

⏰ Full Time

🟠 Senior

💻 Application Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Figure

WebsiteLinkedInAll Job Openings

501 - 1000 employees

💸 Finance

💳 Fintech

🏦 Banking

Finance • Fintech • Banking

Figure is transforming the trillion-dollar financial services industry using blockchain technology. Founded in 2018 by technology entrepreneur Mike Cagney, Figure has established itself as a groundbreaking player in the fintech space with a focus on home equity products, consumer lending, and asset management. Leveraging the Provenance Blockchain, Figure delivers innovative solutions for loan origination, equity management, and financial transactions, aiming to provide speed, efficiency, and savings for both consumers and institutions. It stands out as one of the few unicorns in the financial technology sector.

📋 Description

• Own and evolve Figure's vulnerability management program, including triage, prioritization, remediation tracking, and risk-reduction reporting • Integrate security gates with DevOps throughout the software development lifecycle • Manage third-party penetration tests, including scoping, vendor coordination, and remediation tracking • Automate routine patching and dependency upgrades • Lead threat modeling, architecture reviews, and security design reviews • Lead cross-team initiatives to improve the security posture • Define and drive the application security strategy and roadmap, including secure coding standards and security requirements • Mentor engineers and build a scalable security champions program • Evaluate, select, and own application security tooling and vendors • Track program metrics and communicate application security risk to engineering and executive leadership • Participate in incident response, on-call rotations, and post-incident reviews • Use AI for threat hunting, vulnerability scanning, and triage • Design and build AI agents for infrastructure and code testing and analysis

🎯 Requirements

• 6-8+ years in application security, product security, or a security-focused software engineering role • Strong coding ability in one or more languages used in modern web/backend development (e.g., Go, Python, TypeScript/JavaScript, Java/Kotlin) • Hands-on experience building or scaling a vulnerability management program, including triage, prioritization, and remediation workflows • Experience integrating security tooling into CI/CD (SAST, DAST, SCA, secrets scanning, IaC scanning) and tuning it for signal over noise • Familiarity with software supply-chain security and dependency vetting (e.g., SCA platforms, Semgrep, Snyk, Socket, or comparable) • Deep knowledge of the OWASP Top 10, secure coding patterns, and common vulnerability classes • Extensive experience leading threat modeling and security design reviews • Strong cross-functional collaboration skills and ability to drive remediation across teams • Track record of leading application security initiatives end to end • Experience mentoring engineers and running or growing a security champions program • Ability to communicate risk and tradeoffs clearly to engineers and leadership • Deep expertise in at least one area such as authentication and authorization, cryptography, API security, or cloud-native application security • Hands-on proficiency with AI-assisted security tooling • Adhere to company security policies and data handling procedures • Complete mandatory security awareness training within required timeframes • Promptly report suspected security incidents or suspicious activity • Cloud security exposure and prior blockchain/Web3 security experience are pluses, not requirements • Familiarity with SOC 2, PCI DSS, or GLBA is a plus • Must verify identity and eligibility to work in the United States • Figure will not sponsor work visas for this position

🏖️ Benefits

• 25% annual bonus target, paid quarterly • Company equity in the form of RSUs • Comprehensive medical, dental, and vision coverage, with 100% employer-paid premiums for employees and their dependents on select plans • Company HSA, FSA, Dependent Care FSA, 401(k), and commuter benefits • Employer-paid life and disability insurance • 11 observed holidays and PTO plan • Up to 12 weeks of paid family leave • Continuing education reimbursement