Application Security Engineer

Dropbox

2d • $172,000 - $261,900

About The Position

As part of Dropbox’s Product Security Engineering team, the Application Security Engineer reduces risk at scale by building security infrastructure, automation, and tooling that helps engineers ship secure products. The team works with engineering and product teams throughout the software development lifecycle (SDLC), embedding secure-by-default practices and delivering scalable solutions.

The role involves implementing security tooling, writing custom security rules, and building frameworks that address broad classes of vulnerabilities. It also supports teams through threat modeling, documentation, and education to strengthen security culture across Dropbox. The role may include participation in an on-call rotation if the assigned team has one; rotations can require availability during core and non-core business hours.

Requirements

• At least 4 years of experience in application security or security engineering roles.
• Hands-on experience building or using security automation tools to improve developer workflows and product security.
• Demonstrated ability to work across the SDLC, including supporting and interpreting findings from penetration tests and bug bounty reports.
• Familiarity with modern technology stacks, including microservices, CI/CD pipelines, and cloud-native environments.
• Solid understanding of common vulnerability classes, such as injection, XSS, and authentication or authorization issues, and practical mitigation strategies.
• Comfort working cross-functionally and supporting multiple product and engineering teams simultaneously.

Nice To Haves

• Experience participating in or supporting incident response or security on-call rotations.
• Application security engineering experience with a strong focus on security tooling and automation.
• Ability to write and maintain custom security rules and integrate them into developer workflows.
• Experience with machine learning systems, particularly generative AI, and supporting secure development in AI-driven products.
• Experience developing internal libraries or frameworks that reduce or eliminate entire classes of vulnerabilities.
• Proficiency in software development, including production-level contributions in one or more modern programming languages.
• Familiarity with securing web, mobile, and native applications.
• Experience with data security, including tooling for data protection, access control, and encryption.
• Strong communication skills and the ability to build trusted partnerships with cross-functional teams.

Responsibilities

• Build and maintain security tools, automation, and libraries that enable secure-by-default development across engineering teams.
• Design and implement custom security rules, such as Semgrep and CodeQL rules, to detect and prevent common and emerging vulnerability patterns.
• Serve as a subject matter expert on application security across web, mobile, and desktop environments.
• Improve and scale the Secure Development Lifecycle by integrating tools, checks, and processes into engineering workflows.
• Perform targeted code reviews and develop follow-up tooling or controls to prevent regressions.
• Collaborate with engineering, product, GRC, and AI/ML teams to proactively address security risks, particularly in emerging and fast-moving technology areas.
• Participate in an on-call rotation if the assigned team has one.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed