Dropbox is a Virtual First company. For this role, we are hiring in Zones 2 and 3. Zones are determined by your zip code; if you’re within 100 miles of a listed metro area (straight-line radius), you’re included in that Zone. Please check your Zone in the Compensation section below.
Role Description
As part of the Product Security Engineering team, you’ll focus on reducing risk at scale by building the security infrastructure, automation, and tooling that empowers engineers to ship secure products with confidence. We work closely with engineering and product teams throughout the software development lifecycle (SDLC), embedding secure-by-default practices and delivering scalable solutions.
Product Security Engineers create impact by implementing security tooling, writing custom security rules, and building frameworks that address broad classes of vulnerabilities. In addition to proactive development, we support teams through threat modeling, documentation, and education to uplift security culture across Dropbox.
Our Engineering Career Framework is viewable by anyone outside the company and describes what’s expected for our engineers at each of our career levels. Check out our blog post on this topic and more here.
Responsibilities
- Build and maintain security tools, automation, and libraries to enable secure-by-default development across engineering teams.
- Design and implement custom security rules (e.g., Semgrep, CodeQL) to detect and prevent common and emerging vulnerability patterns.
- Act as a subject matter expert on application security across web, mobile, and desktop environments.
- Improve and scale the Secure Development Lifecycle (SDLC) by integrating tools, checks, and processes into engineering workflows.
- Perform targeted code reviews, and develop follow-up tooling or controls to prevent regressions.
- Collaborate cross-functionally with engineering, product, GRC, and AI/ML teams to proactively address security risks, especially in fast-moving and emerging tech areas.
Many teams at Dropbox run Services with on-call rotations, which entails being available for calls during both core and non-core business hours. If a team has an on-call rotation, all engineers on the team are expected to participate in the rotation as part of their employment. Applicants are encouraged to ask for more details of the rotations to which the applicant is applying.
Requirements
- 4+ years of experience in application security or security engineering roles.
- Hands-on experience building or using security automation tools to improve developer workflows and product security.
- Demonstrated ability to work across the SDLC, including supporting and interpreting findings from penetration tests and bug bounty reports.
- Familiarity with modern tech stacks, including microservices, CI/CD pipelines, and cloud-native environments.
- Solid understanding of common vulnerability classes (e.g., injection, XSS, authN/authZ issues) and practical mitigation strategies.
- Comfortable working in cross-functional environments and supporting multiple product and engineering teams simultaneously.
- Experience participating in or supporting incident response or security on-call rotations is a plus
Preferred Qualifications
- Experience in application security engineering, with a strong focus on security tooling and automation.
- Demonstrated ability to write and maintain custom security rules and integrate them into developer workflows.
- Experience with machine learning systems, particularly generative AI, and the ability to support secure development in AI-driven products.
- Experience developing internal libraries or frameworks that reduce or eliminate entire classes of vulnerabilities.
- Proficient in software development, with experience contributing production-level code in one or more modern languages.
- Familiarity with securing diverse application types, including web, mobile, and native platforms.
- Experience with data security, including tooling for data protection, access control, and encryption.
- Strong communication skills and ability to build trusted partnerships with cross-functional teams.
Durable Skills
AI fluency means using these tools to amplify human judgment, not replace it. We believe people with these skills will thrive as work and technology continue to evolve:
- Awareness: Understand yourself and others.
- Judgment: Evaluate information and make decisions in complex situations.
- Adaptability: Learn, adjust, and stay effective through change.
- Connection: Communicate, collaborate, and build trust.
To learn more about why these skills matter and what the data shows about thriving through change, read this blog post from our Chief People Officer, Melanie Rosenwasser.
Compensation
US Zone 1
This role is not available in Zone 1
US Zone 2
$193,500—$261,900 USD
US Zone 3
$172,000—$232,800 USD
Salary/OTE is just one component of Dropbox’s total rewards package. All regular employees are also eligible for the corporate bonus program or a sales incentive (target included in OTE) as well as stock in the form of Restricted Stock Units (RSUs).
Dropbox takes a number of factors into account when determining individual starting pay, including job and level they are hired into, location/metropolitan area, skillset, and peer compensation. We target most new hire offers between the minimum up to the middle of the range.
Dropbox uses the zip code of an employee’s remote work location to determine which metropolitan pay range we use. Current US Zone locations are as follows:
- US Zone 1: San Francisco metro, New York City metro, or Seattle metro
- US Zone 2: California (outside SF metro), Colorado, Connecticut (outside NYC metro), Delaware, Illinois (Chicago metro), Indiana (Chicago metro), Maryland, Massachusetts, Michigan (Chicago metro), New Hampshire, New Jersey (outside NYC metro), New York (outside NYC metro), Oregon, Pennsylvania (D.C. metro), Pennsylvania (outside NYC metro), Texas (Austin metro) Virginia (DC metro), Washington (outside Seattle metro), Washington DC metro, West Virginia (DC metro), Wisconsin (Chicago metro)
- US Zone 3: All other US locations
Check Your Zone
Company Description
Dropbox isn’t just a workplace—it’s a living lab for designing a more enlightened way of working. We’re a global community of bold visionaries and resourceful doers shaping the future of Dropbox and, in turn, the future of work. Our Virtual First model combines the autonomy of a distributed workplace with the power of human connection, creating space for meaningful work and lasting relationships. With a startup mindset and enterprise-level opportunities, we expect Dropbox employees to think critically, stay curious, and use modern tools, including AI, to improve how work gets done. Here, you can be who you are and grow into who you’re meant to be. You own your impact, helping make work more intuitive, joyful, and human for yourself and hundreds of millions of people worldwide. If you’re ready to push boundaries and challenge yourself, Dropbox is ready for you.
Team Description
The Dropbox Engineering Team develops the technology, platforms, and products that create more enlightened ways of working for hundreds of millions of people. Customers rely on Dropbox to manage, share, and collaborate on content seamlessly—our engineering makes that easier and more intuitive than ever before.Our platform features a robust systems software layer that stores and processes exabytes of data, and a suite of growing services that enhance core products like our sharing and sync engine. We’re also driving innovation with new offerings such as Dash, our AI-powered knowledge management engine. Our infrastructure spans high-performance servers and cutting-edge components across multiple data centers worldwide, ensuring reliability, speed, and scalability at a global scale. We think like a startup but build for an enterprise, exploring new possibilities that transform how people work. If you're excited about turning complex technical challenges into intuitive solutions at scale, join our Engineering team.
Virtual First
Dropbox’s Virtual First way of working is designed to help people do their best work with flexibility, autonomy, and connection. Day to day, teams work remotely with nonlinear schedules and core collaboration hours that support deep focus and individual working styles. We prioritize asynchronous communication to improve clarity, respect deep work time, and reduce unnecessary meetings. While remote work is the primary experience for our employees, we also prioritize intentional, in-person connection. We bring teams together through regular team gatherings, on-demand workspaces, and Dropbox Neighborhood events in order to strengthen team cohesion, foster creativity, and enhance momentum. Virtual First is built to provide the same access to opportunity, growth, and impact for everyone, regardless of location.
This role requires travel to offsites and various other team gatherings (approximately 5-10% of the year or 2-3 days per quarter). We provide advance notice when possible and encourage candidates to discuss any accommodation needs during the interview process.
AI Fluency
- Ownership: You use AI responsibly by protecting data, applying sound judgment, and taking accountability for the quality and accuracy of your work.
- Experimentation: You explore new AI capabilities and apply them to improve workflows within approved tools and practices.
- Leverage: You use AI to enhance thinking, improve efficiency, and increase your impact and your team’s.
- Learning: You stay current on emerging AI tools and trends, continuously build your skills, and share what you learn with others.
Dropbox is an equal opportunity employer. We are a welcoming place for everyone, and we do our best to make sure all people feel supported and connected at work.
