Job description

Figure is an AI robotics company developing autonomous general-purpose humanoid robots. The goal of the company is to ship humanoid robots with human level intelligence. Its robots are engineered to perform a variety of tasks in the home and commercial markets. Figure is headquartered in San Jose, CA. We're looking for an Infrastructure Security Engineer to join the Security & Privacy team at Figure, focused on designing, implementing, and managing the security controls and frameworks that protect the company's backend services and infrastructure. This includes building strong foundations that let employees move quickly and safely: secure defaults, paved paths, and self-service guardrails. We are an engineering team. Controls ship as code, changes are versioned and reviewed, and posture is measured rather than asserted. This is a senior, hands-on individual contributor role. Nobody arrives deep in all of it; we want real depth in one of endpoint engineering, identity and access, or application access design, working knowledge of the rest, and room to build depth here. This space is still being built out, so you'll also have latitude to shape the roadmap toward the work you find most interesting. Responsibilities : Partner across teams Work with the DevOps and Infrastructure teams to securely roll out AI tooling across our infrastructure, securing the deployment path, service-to-service communication, and the network boundaries around these workloads. Partner with the Networking team on data-center and cloud network security: NSGs, segmentation, VPC structure, private connectivity, and egress policy. Enable the Detection & Response team by making every environment produce the telemetry they need, and provide environment access and context during incidents. Authentication / Authorization Own multi-cloud authentication and authorization: centralized SSO for human identities, workload identity and federated credentials for machine identities, and consistent, least-privilege access policy across cloud providers. Extend that identity model to on-prem and neocloud environments, including hardware-rooted machine identity so all our infrastructure inherits the same authN/authZ guarantees as our cloud backends. Drive the move away from long-lived reusable credentials toward sealed, short-lived, workload-scoped authentication, and build just-in-time, time-bound elevated access. Visibility Measure posture: build the tooling and pipelines for asset and identity inventory, configuration drift detection, and coverage metrics across cloud, on-prem, and neocloud environments. Turn misconfiguration and vulnerability findings into tracked, closed-loop remediation across every environment class. Networking Advance our zero-trust networking model as the universal access layer: identity-aware, posture-gated access to internal services with no public IPs and no cross-environment traffic outside the overlay. Design and enforce egress controls so workloads can't make arbitrary outbound calls. Define the secure-by-default networking patterns other teams build on top of, so segmentation and access rules are versioned, reviewed, and auditable rather than hand-configured. Requirements: Experience and security knowledge of one or more domains and technologies: Kubernetes, containers, service mesh, networking, operating system internals, authentication/authorization protocols, and cloud security tools. Experience developing and deploying services in multi-cloud environments, preferably familiar with a multi-cloud infrastructure spanning at least two of the three: Azure, AWS, or Google Cloud Platform. 6+ years of security / software development experience. Strong software engineering skills (not scripting or automation) skills in C/C++, Rust, Golang, Python or similar. Passion for learning and helping others. Excellent verbal and written communication skills, with high attention to detail. BS/BA in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field Bonus Qualifications: Familiarity with zero-trust networking, posture-based access control, and egress/segmentation design. Hands-on with workload identity / federated credentials, and secrets management. Experience with delivering security controls as reviewed, versioned code. Familiarity with securing AI/ML tool usage across infrastructure. Track record of building self-service security tooling and paved paths that scale to a fast-moving engineering org. Experience securing on-prem or neocloud alongside public cloud. The US base salary range for this full-time position is $150,000 - $250,000 per year. The pay offered for this position may vary based on several individual factors, including job-related knowledge, skills, and experience. The total compensation package may also include additional components/benefits depending on the specific role. This information will be shared if an employment offer is extended.

Requirements

Must-haves

Partner across teams
Work with the DevOps and Infrastructure teams to securely roll out AI tooling across our infrastructure, securing the deployment path, service-to-service communication, and the network boundaries around these workloads.
Partner with the Networking team on data-center and cloud network security: NSGs, segmentation, VPC structure, private connectivity, and egress policy.
Enable the Detection & Response team by making every environment produce the telemetry they need, and provide environment access and context during incidents.
Authentication / Authorization
Extend that identity model to on-prem and neocloud environments, including hardware-rooted machine identity so all our infrastructure inherits the same authN/authZ guarantees as our cloud backends.
Drive the move away from long-lived reusable credentials toward sealed, short-lived, workload-scoped authentication, and build just-in-time, time-bound elevated access.
Measure posture: build the tooling and pipelines for asset and identity inventory, configuration drift detection, and coverage metrics across cloud, on-prem, and neocloud environments.
Turn misconfiguration and vulnerability findings into tracked, closed-loop remediation across every environment class.
Advance our zero-trust networking model as the universal access layer: identity-aware, posture-gated access to internal services with no public IPs and no cross-environment traffic outside the overlay.
Design and enforce egress controls so workloads can't make arbitrary outbound calls.
Define the secure-by-default networking patterns other teams build on top of, so segmentation and access rules are versioned, reviewed, and auditable rather than hand-configured.
Experience and security knowledge of one or more domains and technologies: Kubernetes, containers, service mesh, networking, operating system internals, authentication/authorization protocols, and cloud security tools.
Experience developing and deploying services in multi-cloud environments, preferably familiar with a multi-cloud infrastructure spanning at least two of the three: Azure, AWS, or Google Cloud Platform.
6+ years of security / software development experience.
Strong software engineering skills (not scripting or automation) skills in C/C++, Rust, Golang, Python or similar.
Passion for learning and helping others.
Excellent verbal and written communication skills, with high attention to detail.
BS/BA in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field
Familiarity with zero-trust networking, posture-based access control, and egress/segmentation design.
Hands-on with workload identity / federated credentials, and secrets management.
Experience with delivering security controls as reviewed, versioned code.
Familiarity with securing AI/ML tool usage across infrastructure.
Track record of building self-service security tooling and paved paths that scale to a fast-moving engineering org.

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

airestkubernetesazureawsrustgolangpythonml

Platform: greenhouse
Effort: quick