Compliance Engineer

Role

Figma is hiring a Compliance Engineer to design, implement, and test security controls across FedRAMP, SOC 2, ISO 27001, and NIST frameworks. Partner with security, infrastructure, and product engineering teams to translate regulatory requirements into technical controls and build scalable, repeatable compliance practices. The role uses automation, machine-readable JSON control definitions, APIs, and AI-assisted development tools to improve testing, evidence collection, and continuous monitoring.

This full-time role can be based at a US hub or performed remotely within the United States. Listed locations include San Francisco, CA, and New York, NY.

Responsibilities

• Develop and verify technical security controls that satisfy multiple compliance frameworks.
• Collaborate with engineering teams to translate compliance requirements into effective technical controls.
• Design and execute control tests, identify gaps, and verify remediation.
• Establish repeatable assessments and continuous monitoring to evaluate compliance effectiveness.
• Translate security requirements into structured JSON definitions for control management, testing, and automation.
• Build and maintain API integrations and automated workflows for evidence collection, control validation, and compliance processes.
• Improve control effectiveness, reduce manual effort, and scale compliance operations across frameworks.

Qualifications

• At least 5 years of hands-on experience in security compliance, security assurance, IT audit, or compliance engineering.
• Experience with FedRAMP, SOC 2, ISO 27001, and NIST 800-53, including designing, implementing, and testing technical security controls in SaaS or cloud environments.
• Experience testing controls for design and operating performance, identifying gaps, and confirming fixes.
• Understanding of cloud security concepts, including identity and access management, vulnerability management, logging, and security configurations.
• Experience working with engineering teams to implement compliance requirements as technical solutions.
• Experience applying JSON, REST APIs, and automation to compliance engineering challenges.

Preferred Qualifications

• Experience developing JSON-based control definitions, JSON Schema, or machine-readable compliance documentation, plus REST API integrations and custom automation workflows.
• Familiarity with Open Security Controls Assessment Language (OSCAL).
• Proficiency in Python or similar scripting languages for compliance automation, including automation platforms and automated evidence collection.
• Experience with Git, version control, and collaborative development workflows.
• Hands-on cloud security technology experience, particularly AWS.

Figma encourages applications from candidates whose experience does not align perfectly with every qualification.

Compensation and Benefits

• Annual base salary: $169,000–$296,000 USD. Level and compensation depend on assessed qualifications, potential impact, role scope, market demands, and work location.
• Equity; health, dental, and vision coverage; retirement benefits with company contributions; parental leave and reproductive or family planning support; mental health and wellness benefits; and paid time off.
• Exempt employees receive flexible paid PTO, subject to manager approval, and flexible paid sick leave. Paid holidays and other leave benefits are also provided.
• Additional benefits may include recharge days, cell phone and home internet reimbursements, and lifestyle spending accounts.
• Eligible non-sales roles may participate in an annual bonus plan. Compensation and benefits are subject to applicable plan terms and may change.

Interview and Application Rules

• Candidates must keep cameras on during video interviews.
• Hired candidates must attend in-person onboarding.
• Candidates may submit up to five applications in any rolling 30-day period.
• Candidates may not reapply to the same role while an application is active or within 90 days of rejection. Reapplication is permitted after the applicable period.
• Application and supporting-material personal data are processed under Figma's Candidate Privacy Notice.
• Accommodation requests may be sent to accommodations-ext@figma.com. Accommodations can include accessible interview locations, closed captioning, screen-reader-compatible written communication, and changes to interview mode or format.