Security Engineer - Infrastructure Security

Figure is an AI Robotics company developing a general purpose humanoid. Our humanoid robot is designed for commercial tasks and the home. We are based in San Jose, CA and require 5 days/week in-office collaboration. It’s time to build.

We're looking for an Infrastructure Security Engineer to join the Security & Privacy team at Figure, focused on designing, implementing, and managing the security controls and frameworks that protect the company's backend services and infrastructure. This includes building strong foundations that let employees move quickly and safely: secure defaults, paved paths, and self-service guardrails.

We are an engineering team. Controls ship as code, changes are versioned and reviewed, and posture is measured rather than asserted. This is a senior, hands-on individual contributor role. Nobody arrives deep in all of it; we want real depth in one of endpoint engineering, identity and access, or application access design, working knowledge of the rest, and room to build depth here.

This space is still being built out, so you'll also have latitude to shape the roadmap toward the work you find most interesting.

• Work with the Dev Ops and Infrastructure teams to securely roll out AI tooling across our infrastructure, securing the deployment path, service-to-service communication, and the network boundaries around these workloads.
• Partner with the Networking team on data-center and cloud network security: NSGs, segmentation, VPC structure, private connectivity, and egress policy.
• Enable the Detection & Response team by making every environment produce the telemetry they need, and provide environment access and context during incidents.

• Own multi-cloud authentication and authorization: centralized SSO for human identities, workload identity and federated credentials for machine identities, and consistent, least-privilege access policy across cloud providers.
• Extend that identity model to on-prem and neocloud environments, including hardware-rooted machine identity so all our infrastructure inherits the same authN/authZ guarantees as our cloud backends.
• Drive the move away from long-lived reusable credentials toward sealed, short-lived, workload-scoped authentication, and build just-in-time, time-bound elevated access.

• Measure posture: build the tooling and pipelines for asset and identity inventory, configuration drift detection, and coverage metrics across cloud, on-prem, and neocloud environments.
• Turn misconfiguration and vulnerability findings into tracked, closed-loop remediation across every environment class.

• Advance our zero-trust networking model as the universal access layer: identity-aware, posture-gated access to internal services with no public IPs and no cross-environment traffic outside the overlay.
• Design and enforce egress controls so workloads can't make arbitrary outbound calls.
• Define the secure-by-default networking patterns other teams build on top of, so segmentation and access rules are versioned, reviewed, and auditable rather than hand-configured.

• Experience and security knowledge of one or more domains and technologies:
  Kubernetes, containers, service mesh, networking, operating system internals, authentication/authorization protocols, and cloud security tools.
• Experience developing and deploying services in multi-cloud environments, preferably familiar with a multi-cloud infrastructure spanning at least two of the three:
  Azure, AWS, or Google Cloud Platform.
• 6+ years of security / software development experience.
• Strong software engineering skills (not scripting or automation) skills in C/C++, Rust, Golang, Python or similar.
• Passion for learning and…