Security Engineer

Role Overview

Security Engineer at Figma. You’ll drive systemic security improvements across Figma’s product, platform, and IT systems while partnering with teams across the company. This is a remote-first role with eligibility to work from US hubs or remotely in the United States.

Security Engineering Teams (multiple openings)

• AI Security: secure AI infrastructure, platforms, models, tooling, and data pipelines.
• Platform Security: secure Figma’s cloud and corporate infrastructure.
• Product Security: secure new product features and services.
• Anti-Abuse: prevent spam, fraud, and abuse through detection and response systems.

Responsibilities

• Perform technical security assessments, code audits, and design reviews.
• Design and build technical solutions to reduce risk and prevent vulnerabilities.
• Advocate for secure practices across AI infrastructure, cloud/corporate systems, and product development.
• Participate in operational security work such as:
  • Security reviews
  • Vulnerability triage
  • Security incident response
  • Supporting penetration testing and offensive security exercises (including bug bounty program support for product security)

Examples by team

• AI Security: secure AI models and tooling; develop security tooling; run offensive security exercises for AI systems.
• Platform Security: mitigate cloud and corporate security risks; build detection/response tooling for infrastructure threats.
• Product Security: assess and secure product features; respond to product security incidents; support bug bounty.
• Anti-Abuse: build systems to detect/prevent abusive behavior; improve detection signals; respond to spam/fraud/abuse incidents.

Requirements

• 5+ years of proven engineering experience in Security Engineering or Software Engineering (security experience preferred if from software).
• Strong security judgment in threat modeling and risk prioritization, or strong technical judgment building maintainable, scalable systems.
• Proficiency in at least one general-purpose programming language.
• Strong communication and cross-functional collaboration skills.

Nice to Have

• Subject matter expertise in Application Security, Cloud Security, Corporate Security, Data Access Governance, and/or IAM (Identity and Access Management).
• Demonstrated ability to make difficult prioritization decisions about security controls.