Security Engineers at Dropbox safeguard our digital ecosystem alongside a diverse team of professionals dedicated to protecting our products and users. Trusted by millions, our mission is to integrate security seamlessly into Dropbox, empowering confident collaboration.
In this role, you’ll help shape how Dropbox secures AI systems and agentic workflows, building and operating the controls that protect the infrastructure, tools, and data they rely on. You’ll tackle challenges such as prompt injection, secure agent access, and MCP integrations, turning emerging risks into practical, reusable safeguards. Partnering across engineering and security, you’ll lead hands-on work that enables teams to adopt AI safely while protecting customer data.
Our Engineering Career Framework is viewable by anyone outside the company and describes what’s expected for our engineers at each of our career levels. Check out our blog post on this topic and more here.
Many teams at Dropbox run Services with on-call rotations, which entails being available for calls during both core and non-core business hours. If a team has an on-call rotation, all engineers on the team are expected to participate in the rotation as part of their employment. Applicants are encouraged to ask for more details of the rotations to which the applicant is applying.
AI fluency means using these tools to amplify human judgment, not replace it. We believe people with these skills will thrive as work and technology continue to evolve:
To learn more about why these skills matter and what the data shows about thriving through change, read this blog post from our Chief People Officer, Melanie Rosenwasser.
US Zone 1
This role is not available in Zone 1
Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
Build and operate identity and access controls across cloud and on-premises infrastructure, securing employee, service, and AI-agent access through automation, least privilege, and reliable IAM services.
Evaluate SAST tools against GenAI application vulnerabilities by building and testing realistic LLM agent and RAG security scenarios, tracing data flows, defining authorization contexts, and documenting findings.
Strengthen product security across the software development lifecycle by reviewing applications, APIs, and code, assessing vulnerabilities, and partnering with engineering teams on practical remediation.
Own RF monitoring, technical surveillance countermeasures, and emanations security for data center sites, building detection systems and automation and approving controls before sites open.
