{"id":4198084,"url":"https://alion.io/job/dropbox-application-security-engineer-2","title":"Application Security Engineer","company":{"id":4307,"name":"Dropbox","domain":"dropbox.com","url":"https://alion.io/company/dropbox","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":83,"open_postings":11,"ghost_share":0,"stale_share":0.455,"repost_share":0.364,"time_to_fill_p50_days":31,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mexico"],"countries":["MX"],"hiring_countries":["MX"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CodeQL","optional":false},{"name":"Dropbox","optional":false},{"name":"Semgrep","optional":false},{"name":"Threat Modeling","optional":false},{"name":"CI/CD","optional":true},{"name":"Machine Learning","optional":true}],"status":"live","first_seen_at":"2026-11-12T17:57:36Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-12T21:08:51Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Role Description\nAs part of the Product Security Engineering team, you’ll focus on reducing risk at scale by building the security infrastructure, automation, and tooling that empowers engineers to ship secure products with confidence. We work closely with engineering and product teams throughout the software development lifecycle (SDLC), embedding secure-by-default practices and delivering scalable solutions.\nProduct Security Engineers create impact by implementing security tooling, writing custom security rules, and building frameworks that address broad classes of vulnerabilities. In addition to proactive development, we support teams through threat modeling, documentation, and education to uplift security culture across Dropbox.\nOur Engineering Career Framework is viewable by anyone outside the company and describes what’s expected for our engineers at each of our career levels. Check out our blog post on this topic and more here.\nResponsibilities\nBuild and maintain security tools, automation, and libraries to enable secure-by-default development across engineering teams.\nDesign and implement custom security rules (e.g.,Semgrep, CodeQL) to detect and prevent common and emerging vulnerability patterns.\nAct as a subject matter expert on application security across web, mobile, and desktop environments.\nImprove and scale the Secure Development Lifecycle (SDLC)by integrating tools, checks, and processes into engineering workflows.\nPerform targeted code reviews, and develop follow-up tooling or controls to prevent regressions.\nCollaborate cross-functionally with engineering, product, GRC, and AI/ML teams to proactively address security risks, especially in fast-moving and emerging tech areas.\nMany teams at Dropbox run Services with on-call rotations, which entails being available for calls during both core and non-core business hours. If a team has an on-call rotation, all engineers on the team are expected to participate in the rotation as part of their employment. Applicants are encouraged to ask for more details of the rotations to which the applicant is applying.\nRequirements\n4+ years of experience in application security or security engineering roles.\nHands-on experience building or using security automation tools to improve developer workflows and product security.\nDemonstrated ability to work across the SDLC, including supporting and interpreting findings from penetration tests and bug bounty reports.\nFamiliarity with modern tech stacks, including microservices, CI/CD pipelines, and cloud-native environments.\nSolid understanding of common vulnerability classes (e.g.,injection, XSS, authN/authZ issues) and practical mitigation strategies.\nComfortable working in cross-functional environments and supporting multiple product and engineering teams simultaneously.\nExperience participating in or supporting incident response or security on-call rotations is a plus\nPreferred Qualifications\nExperience in application security engineering, with a strong focus on security tooling and automation.\nDemonstrated ability to write and maintain custom security rules and integrate them into developer workflows.\nExperience with machine learning systems, particularly generative AI, and the ability to support secure development in AI-driven products.\nExperience developing internal libraries or frameworks that reduce or eliminate entire classes of vulnerabilities.\nProficient in software development, with experience contributing production-level code in one or more modern languages.\nFamiliarity with securing diverse application types, including web, mobile, and native platforms.\nExperience with data security, including tooling for data protection, access control, and encryption.\nStrong communication skills and ability to build trusted partnerships with cross-functional teams.\nDurable Skills\nAI fluency means using these tools to amplifyhuman judgment, not replace it. We believe people with these skills will thrive as work and technologycontinue to evolve:\nAwareness: Understand yourselfand others.\nJudgment: Evaluateinformation and make decisions in complex situations.\nAdaptability: Learn, adjust, and stay effective through change.\nConnection: Communicate, collaborate, and build trust.\nTo learn more about why these skills matter and what the data shows about thriving through change, read this blog post fromour Chief People Officer, Melanie Rosenwasser.\nCompensation","description_format":"text","description_chars":4424,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Mexico","iso":"MX","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Digital Signature","Team Communication & Collaboration","Cloud Storage & File Sharing"],"lifecycle":[{"event":"open","at":"2026-11-12T21:08:51Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":31,"reasons":["conf:4","win:early"],"computed_at":"2026-11-13T01:53:01Z"},"pay":null,"html_url":"https://alion.io/job/dropbox-application-security-engineer-2","json_url":"https://alion.io/job/dropbox-application-security-engineer-2.json","meta":{"generated_at":"2026-11-13T01:53:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4023,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4307},"rest":"https://alion.io/mcp/rest/get_company?id=4307"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdropbox-application-security-engineer-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdropbox-application-security-engineer-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdropbox-application-security-engineer-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/dropbox-application-security-engineer-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdropbox-application-security-engineer-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4198084}},{"tool":"search_jobs","arguments":{"company":"dropbox.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4198084},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}