Security Engineer

Role overview

You’ll join Figma as a Security Engineer to identify and drive high-impact security projects that improve the security of Figma’s product, platform, and IT systems. The role is remote-first and you’ll work with multiple Security Engineering teams: AI Security, Platform Security, Product Security, and Anti-Abuse.

Responsibilities

• Perform technical security assessments, code audits, and design reviews across relevant systems (AI infrastructure, cloud/corporate infrastructure, product features).
• Design and develop security solutions to prevent or mitigate risks and vulnerabilities.
• Advocate for secure development and operating practices across Figma teams.
• Contribute to operational security work such as:
  • Security reviews
  • Vulnerability triage
  • Security incident response
  • Supporting penetration testing and offensive security exercises
  • Supporting bug bounty efforts (Product Security)

Team examples

• AI Security: secure AI models, tooling/debugging workflows, and data pipelines; build AI-powered access insights and security tooling; run pen tests/offensive exercises targeting AI systems.
• Platform Security: assess and secure cloud and corporate infrastructure; build detection/response tooling for infrastructure threats.
• Product Security: assess and secure new product features; help respond to product security incidents; support bug bounty and offensive testing.
• Anti-Abuse: build systems to prevent spam/fraud/abuse; develop and improve abuse detection signals; support response to abuse incidents.

Requirements

• 5+ years engineering experience in Security Engineering or Software Engineering (security experience preferred in the latter).
• Strong security judgment (threat modeling and risk prioritization) and/or strong technical judgment for scalable maintainable systems.
• Proficiency in at least one general-purpose programming language.
• Strong communication and cross-functional collaboration skills.

Nice to have

• Subject matter expertise in one or more of: Application Security, Cloud Security, Corporate Security, Data Access Governance, IAM (Identity and Access Management).
• Experience making hard prioritization decisions for security controls.

Work location / type

• Full-time role.
• Can be held from US hubs or remotely in the United States.