Security Engineer (Enterprise Security)

Join Figure, a cutting-edge technology company, as a Corporate Security Engineer. In this senior, hands-on role, you will be responsible for building endpoint hardening controls, binding data access to managed devices, and designing application authentication and access lifecycle. You will also run security reviews and governance for SaaS and third parties, build inventories for application discovery and vulnerability management, and threat model the corporate attack surface. The ideal candidate will have 6+ years of experience in corporate or enterprise security engineering, a bachelor's degree in computer science or a related field, and expertise in software engineering, identity and access, endpoint security, and application access design.

• Concevoir et mettre en œuvre des contrôles de durcissement des points de terminaison sur divers systèmes d'exploitation.
• Établir des liens entre l'accès aux données et un appareil géré sain, en intégrant des facteurs de résistance au phishing.
• Contribuer à l'élaboration de livres de jeu de déploiement par défaut de l'équipe, en intégrant les enseignements tirés de chaque engagement.

• 6+ years in corporate or enterprise security engineering
• Threat-modeling judgment that separates the problems worth solving from the ones existing controls already cover, and drives the former to completion
• Bachelor's in Computer Science, Engineering, or Information Systems, or equivalent experience
• Software engineering discipline in Python, Bash, PowerShell, or similar: integrations and internal tooling as normal work
• Configuration-as-code and CI/CD applied to corporate infrastructure
• Identity and access: IAM, SaaS security, and zero trust from fundamentals rather than vendor docs, and being able to explain a SAML, OIDC, or SCIM integration for a developer who has never built one. Preferred: mTLS, 802.1X, SSH certificate authorities, and DKIM, DMARC, and SPF in production
• Endpoint security on at least two of macOS, Windows, Linux, and ChromeOS: MDM profile engineering, application allowlisting, endpoint security frameworks, and the OS internals behind them. Preferred: fleet-wide osquery telemetry, certificate-based device identity in production, a phased enforcement change shipped with a recovery plan, and devices that live off the corporate network
• Application access design: threat modeling what an application exposes, specifying authentication and authorization for the team building it, and designing the provisioning and revocation behind it. Preferred: securing agentic or LLM-integrated systems, including permission models, credential isolation, and egress control
• Depth required in at least one of the below, knowledge of the others: