Security Engineers at Dropbox safeguard our digital ecosystem alongside a diverse team of professionals dedicated to protecting our products and users. Trusted by millions, our mission is to integrate security seamlessly into Dropbox, empowering confident collaboration.
In this role, you’ll build and operate the identity and access controls that help Dropbox employees, services, and AI agents access what they need securely. You’ll combine security engineering and automation to strengthen authentication and authorization, enforce least privilege, and simplify identity lifecycle management across our infrastructure. Working closely with Infrastructure, Corp Engineering, Developer Platform, and Incident Response, you’ll make secure access easier to use and maintain reliable IAM services as Dropbox adopts new AI tools and agentic workflows.
Our Engineering Career Framework is viewable by anyone outside the company and describes what’s expected for our engineers at each of our career levels. Check out our blog post on this topic and more here.
Many teams at Dropbox run Services with on-call rotations, which entails being available for calls during both core and non-core business hours. If a team has an on-call rotation, all engineers on the team are expected to participate in the rotation as part of their employment. Applicants are encouraged to ask for more details of the rotations to which the applicant is applying.
AI fluency means using these tools to amplify human judgment, not replace it. We believe people with these skills will thrive as work and technology continue to evolve:
To learn more about why these skills matter and what the data shows about thriving through change, read this blog post from our Chief People Officer, Melanie Rosenwasser.
US Zone 1
This role is not available in Zone 1
Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
Design and operate security controls for AI systems and agentic workflows, securing infrastructure, tools, identities, and data while helping engineering teams adopt AI safely.
Evaluate SAST tools against GenAI application vulnerabilities by building and testing realistic LLM agent and RAG security scenarios, tracing data flows, defining authorization contexts, and documenting findings.
Strengthen product security across the software development lifecycle by reviewing applications, APIs, and code, assessing vulnerabilities, and partnering with engineering teams on practical remediation.
Own RF monitoring, technical surveillance countermeasures, and emanations security for data center sites, building detection systems and automation and approving controls before sites open.
