Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 5 hours ago

Application Security Engineer

Dropbox38 open roles

Pay
$193,500 – $261,900 a year
Where
Remote - US: Select locations
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowApplication Security EngineerDropbox · Remote - US: Select locations

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Dropbox's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.9% of postings close within 7 days. Measured by our own scanner across the market. Dropbox postings stay open a median of 33 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 13.9%7 days
  4. 22.4%14 days
  5. 38.1%30 days
  6. 59.0%60 days
This job: posted 5 hours ago

Dropbox median: 33 days open

The posting

Role Description

As part of the Product Security Engineering team, you’ll focus on reducing risk at scale by building the security infrastructure, automation, and tooling that empowers engineers to ship secure products with confidence. We work closely with engineering and product teams throughout the software development lifecycle (SDLC), embedding secure-by-default practices and delivering scalable solutions.

Product Security Engineers create impact by implementing security tooling, writing custom security rules, and building frameworks that address broad classes of vulnerabilities. In addition to proactive development, we support teams through threat modeling, documentation, and education to uplift security culture across Dropbox.

Our Engineering Career Framework is viewable by anyone outside the company and describes what’s expected for our engineers at each of our career levels. Check out our blog post on this topic and more here.

Responsibilities

  • Build and maintain security tools, automation, and libraries to enable secure-by-default development across engineering teams.
  • Design and implement custom security rules (e.g., Semgrep, CodeQL) to detect and prevent common and emerging vulnerability patterns.
  • Act as a subject matter expert on application security across web, mobile, and desktop environments.
  • Improve and scale the Secure Development Lifecycle (SDLC) by integrating tools, checks, and processes into engineering workflows.
  • Perform targeted code reviews, and develop follow-up tooling or controls to prevent regressions.
  • Collaborate cross-functionally with engineering, product, GRC, and AI/ML teams to proactively address security risks, especially in fast-moving and emerging tech areas.

Many teams at Dropbox run Services with on-call rotations, which entails being available for calls during both core and non-core business hours. If a team has an on-call rotation, all engineers on the team are expected to participate in the rotation as part of their employment. Applicants are encouraged to ask for more details of the rotations to which the applicant is applying.

Requirements

  • 4+ years of experience in application security or security engineering roles.
  • Hands-on experience building or using security automation tools to improve developer workflows and product security.
  • Demonstrated ability to work across the SDLC, including supporting and interpreting findings from penetration tests and bug bounty reports.
  • Familiarity with modern tech stacks, including microservices, CI/CD pipelines, and cloud-native environments.
  • Solid understanding of common vulnerability classes (e.g., injection, XSS, authN/authZ issues) and practical mitigation strategies.
  • Comfortable working in cross-functional environments and supporting multiple product and engineering teams simultaneously.
  • Experience participating in or supporting incident response or security on-call rotations is a plus

Preferred Qualifications

  • Experience in application security engineering, with a strong focus on security tooling and automation.
  • Demonstrated ability to write and maintain custom security rules and integrate them into developer workflows.
  • Experience with machine learning systems, particularly generative AI, and the ability to support secure development in AI-driven products.
  • Experience developing internal libraries or frameworks that reduce or eliminate entire classes of vulnerabilities.
  • Proficient in software development, with experience contributing production-level code in one or more modern languages.
  • Familiarity with securing diverse application types, including web, mobile, and native platforms.
  • Experience with data security, including tooling for data protection, access control, and encryption.
  • Strong communication skills and ability to build trusted partnerships with cross-functional teams.

Durable Skills

AI fluency means using these tools to amplify human judgment, not replace it. We believe people with these skills will thrive as work and technology continue to evolve:

  • Awareness: Understand yourself and others.
  • Judgment: Evaluate information and make decisions in complex situations.
  • Adaptability: Learn, adjust, and stay effective through change.
  • Connection: Communicate, collaborate, and build trust.

To learn more about why these skills matter and what the data shows about thriving through change, read this blog post from our Chief People Officer, Melanie Rosenwasser.

Compensation

US Zone 1

This role is not available in Zone 1

US Zone 2

$193,500—$261,900 USD

US Zone 3

$172,000—$232,800 USD

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Dropbox's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Dropbox's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Dropbox's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.