Security Engineer, Infrastructure Security

About the role

Figure is an AI robotics company developing autonomous general-purpose humanoid robots. The goal of the company is to ship humanoid robots with human level intelligence. Its robots are engineered to perform a variety of tasks in the home and commercial markets. Figure is headquartered in San Jose, CA.

We're looking for an Infrastructure Security Engineer to join the Security & Privacy team at Figure, focused on designing, implementing, and managing the security controls and frameworks that protect the company's backend services and infrastructure. This includes building strong foundations that let employees move quickly and safely: secure defaults, paved paths, and self-service guardrails.

We are an engineering team. Controls ship as code, changes are versioned and reviewed, and posture is measured rather than asserted. This is a senior, hands-on individual contributor role. Nobody arrives deep in all of it; we want real depth in one of endpoint engineering, identity and access, or application access design, working knowledge of the rest, and room to build depth here. This space is still being built out, so you'll also have latitude to shape the roadmap toward the work you find most interesting.

Responsibilities:

Partner across teams

- Work with the DevOps and Infrastructure teams to securely roll out AI tooling across our infrastructure, securing the deployment path, service-to-service communication, and the network boundaries around these workloads.

- Partner with the Networking team on data-center and cloud network security: NSGs, segmentation, VPC structure, private connectivity, and egress policy.

- Enable the Detection & Response team by making every environment produce the telemetry they need, and provide environment access and context during incidents.

Authentication / Authorization

- Own multi-cloud authentication and authorization: centralized SSO for human identities, workload identity and federated credentials for machine identities, and consistent, least-privilege access policy across cloud providers.

- Extend that identity model to on-prem and neocloud environments, including hardware-rooted machine identity so all our infrastructure inherits the same authN/authZ guarantees as our cloud backends.

- Drive the move away from long-lived reusable credentials toward sealed, short-lived, workload-scoped authentication, and build just-in-time, time-bound elevated access.

Visibility

- Measure posture: build the tooling and pipelines for asset and identity inventory, configuration drift detection, and coverage metrics across cloud, on-prem, and neocloud environments.

- Turn misconfiguration and vulnerability findings into tracked, closed-loop remediation across every environment class.

Networking

- Advance our zero-trust networking model as the universal access layer: identity-aware, posture-gated access to internal services with no public IPs and no cross-environment traffic outside the overlay.