Application Security Engineer
Dropbox · Remote - US: Select locations
About this role
**Application Security Engineer** ## Role Description As part of the Product Security Engineering team, you’ll focus on reducing risk at scale by building security infrastructure, automation, and tooling that helps engineers ship secure products with confidence. You’ll embed secure-by-default practices across the SDLC and deliver scalable solutions. Product Security Engineers create impact by implementing security tooling, writing custom security rules, and building frameworks that address broad classes of vulnerabilities. You’ll also support teams through threat modeling, documentation, and education to uplift security culture. ## Responsibilities - Build and maintain security tools, automation, and libraries to enable secure-by-default development. - Design and implement custom security rules (e.g., Semgrep, CodeQL) to detect and prevent common and emerging vulnerability patterns. - Act as a subject matter expert on application security across web, mobile, and desktop environments. - Improve and scale the Secure Development Lifecycle (SDLC) by integrating tools, checks, and processes into engineering workflows. - Perform targeted code reviews, and develop follow-up tooling or controls to prevent regressions. - Collaborate cross-functionally with engineering, product, GRC, and AI/ML teams to proactively address security risks—especially in fast-moving and emerging tech areas. *On-call note:* Many teams run services with on-call rotations. If your team has an on-call rotation, all engineers are expected to participate as part of employment. Applicants are encouraged to ask for details. ## Requirements - 4+ years of experience in application security or security engineering roles. - Hands-on experience building or using security automation tools to improve developer workflows and product security. - Demonstrated ability to work across the SDLC, including supporting and interpreting findings from penetration tests and bug bounty reports. - Familiarity with modern tech stacks (microservices, CI/CD pipelines, cloud-native environments). - Solid understanding of common vulnerability classes (e.g., injection, XSS, authN/authZ issues) and practical mitigation strategies. - Comfortable working cross-functionally and supporting multiple product/engineering teams simultaneously. - Experience participating in or supporting incident response or security on-call rotations is a plus. ## Preferred Qualifications - Strong focus on security tooling and automation in application security engineering. - Demonstrated ability to write and maintain custom security rules and integrate them into developer workflows. - Experience with machine learning systems (especially generative AI) and supporting secure development in AI-driven products. - Experience developing internal libraries or frameworks that reduce or eliminate entire classes of vulnerabilities. - Proficient software development experience contributing production-level code in one or more modern languages. - Familiarity with securing diverse application types (web, mobile, native platforms). - Experience with data security (data protection, access control, encryption). - Strong communication skills and ability to build trusted partnerships across teams.
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.