1 day ago
Base Salary
$194k - $262k/yr
Responsibilities
- Design, deploy, and operate IAM controls across Dropbox’s cloud and on-premises infrastructure.
- Secure identity, authentication, and authorization for AI agents and other non-human actors.
- Implement least-privilege access using RBAC, ABAC, permission boundaries, service control policies, and just-in-time access.
- Design integrations using SAML, OAuth, OpenID Connect, SCIM, and SPIFFE/SPIRE.
- Automate identity lifecycle management, including access grants, changes, revocation, and joiner/mover/leaver workflows.
- Develop identity guardrails with infrastructure-as-code and policy-as-code.
- Build monitoring and alerting for anomalous authentication, privilege escalation, credential misuse, and unauthorized access.
- Partner with Incident Response to investigate identity-related incidents and revoke compromised access.
- Conduct security reviews and threat modeling for identity architectures and integrations.
- Maintain reliable IAM services with documentation, operational ownership, and on-call support.
Requirements
- 5+ years of security engineering experience, including substantial IAM or identity-security experience.
- Hands-on experience with Okta, Okta for AI Agents, SailPoint, or comparable technologies.
- Strong understanding of authentication, authorization, least privilege, zero trust, and identity lifecycle management.
- Experience with SAML, OAuth 2.0/2.1, OpenID Connect, SCIM, and MFA.
- Experience designing RBAC or ABAC authorization models.
- Experience securing human and non-human identities, including services, workloads, automation, and CI/CD systems.
- Experience with agentic frameworks and MCP tool integration.
- Experience implementing access reviews, privileged-access controls, and joiner/mover/leaver workflows.
- Proficiency in at least one programming or scripting language such as Python, Go, Java, Ruby, or Bash.
- Experience with infrastructure-as-code, policy-as-code, APIs, and security automation.
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
- Preferred experience includes SPIFFE/SPIRE, Kubernetes service accounts, cloud workload identity, AI-agent authorization, just-in-time access, zero-standing-privilege, privileged-access management, identity threat detection and response, multi-account cloud environments, NIST standards, CIS benchmarks, SOC 2, ISO 27001, FedRAMP, and security certifications such as CISSP or CCSP.
Benefits
- Engineers on teams with on-call rotations are expected to participate in calls during core and non-core business hours.
- The role is available in US Zone 2 and US Zone 3; it is not available in US Zone 1.
Tech Stack
Categories
About Dropbox
Dropbox builds cloud storage, file sync, sharing, and collaboration tools for individuals and businesses, sold via subscriptions. Its portfolio includes Dropbox, Dropbox Sign for e‑signatures, and DocSend for document sharing and analytics. Founded in 2007 and headquartered in San Francisco, Dropbox is a public company on NASDAQ with more than 700 million registered users across 180 countries.