8 months ago
Base Salary
$190k - $263k/yr
Responsibilities
- Design, build, deploy, and maintain security systems for safe workforce use of AI tools and agents.
- Architect and operate AI gateways, prompt and response logging, egress controls, and other workforce-AI control-plane capabilities.
- Extend identity and access management to agentic and non-human identities, including credential lifecycle, delegation, OAuth grant review, and revocation.
- Create approval paths, scoped permissions, and isolated execution for MCP servers, connectors, and code-running tools.
- Harden enterprise browsers, browser extensions, AI-assisted developer tooling, and local agent runtimes.
- Build policy engines, brokers, approval registries, and internal libraries to enforce AI security controls in real time.
- Lead security architecture reviews and threat modeling for AI vendors, SaaS AI features, and internal agent deployments.
- Define AI security standards, reference architectures, approved usage patterns, and reusable implementation paths.
- Partner with security, infrastructure, legal, privacy, and engineering teams on AI governance and incident-response playbooks.
- Automate security workflows with scripting, infrastructure-as-code, orchestration, and AI-assisted investigation tooling.
- Provide design and code reviews, mentoring, and technical guidance to the security team.
Requirements
- Bachelor's or master's degree in computer science, information security, or a related field, or equivalent practical experience.
- 6+ years of enterprise or corporate security engineering, security platform engineering, application or product security experience, including meaningful recent work with AI or agentic systems.
- Hands-on experience securing enterprise assistants, internal agents, AI tool ecosystems, grounded search or RAG over company data, or AI coding tools.
- Understanding of AI abuse scenarios and the ability to analyze AI workflows and define guardrails.
- Strong identity and access management fundamentals.
- Experience automating security in Python, Go, or a similar language and building tooling, libraries, or platform controls.
- Knowledge of shadow AI, agentic and non-human identity, SaaS-to-SaaS integration risk, browser security, and data-exfiltration paths.
- Strong communication skills and the ability to explain AI risk and business impact.
- Ability to work independently, manage ambiguity, and make secure, risk-profiled recommendations.
- Preferred experience shipping internal security platforms.
- Preferred exposure to isolation and permissioning for autonomous workloads, AI red teaming, or evaluation work.
Benefits
- Healthcare benefits and other company benefits and perks are provided.
- Hybrid work arrangement requiring employees to work from their assigned office at least 3 days per week.
- The role is eligible for equity and benefits.
About Box
Box builds a cloud content management platform for enterprises, combining secure file storage and sharing with collaboration, governance, e-signature, and workflow automation. It sells subscriptions (SaaS) to organizations that need to manage the lifecycle of business content and integrate with productivity apps. Founded in 2005 and headquartered in Redwood City, CA, Box is a public company (NYSE: BOX) used by customers such as JLL, Morgan Stanley, and Nationwide.