Security Engineer, IAM

This is a fully remote position, open to applicants in Canada.

📋 Description

• Develop, implement, and manage IAM controls across Dropbox’s cloud and on-premises systems.

• Create and apply secure identity, authentication, and authorization measures for AI agents and other non-human entities.

• Enforce least-privilege access through RBAC, ABAC, permission boundaries, service control policies, and just-in-time access mechanisms.

• Design secure integrations utilizing SAML, OAuth 2.1, OpenID Connect, SCIM, and SPIFFE/SPIRE standards.

• Automate identity lifecycle management processes to ensure timely granting, modification, and revocation of access.

• Develop identity guardrails through infrastructure-as-code and policy-as-code methodologies.

• Establish monitoring and alert systems for unusual authentication activities, privilege escalation, credential misuse, and unauthorized access attempts.

• Collaborate with the Incident Response team to investigate identity-related incidents and swiftly revoke compromised access.

• Perform security assessments and threat modeling for new identity architectures and integrations.

• Sustain IAM services with high reliability, comprehensive documentation, operational accountability, and on-call support.

• Work closely with Infrastructure, Corp Engineering, Developer Platform, and Incident Response teams.

⛳️ Requirements

• Over 5 years of experience in security engineering, with a significant focus on IAM or identity security.

• Practical experience with Okta, Okta for AI Agents, Sailpoint, or similar technologies.

• In-depth understanding of authentication, authorization, least privilege principles, zero trust, and identity lifecycle management.

• Familiarity with SAML, OAuth 2.0/2.1, OpenID Connect, SCIM, and MFA.

• Experience in designing RBAC or ABAC authorization frameworks.

• Expertise in securing both human and non-human identities, including services, workloads, automation, and CI/CD systems.

• Experience with agentic frameworks and integration of MCP tools.

• Proficient in implementing access reviews, privileged-access controls, and joiner/mover/leaver processes.

• Knowledge in at least one programming or scripting language, such as Python, Go, Java, Ruby, or Bash.

• Experience with infrastructure-as-code, policy-as-code, APIs, and security automation techniques.

• A Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.

• Participation in on-call rotations may be required as part of employment.

🏝️ Benefits

• Comprehensive health, dental, and vision insurance.

• Flexible work hours and remote work opportunities.

• Generous vacation and paid time off policies.

• Professional development and training programs.

• Access to wellness resources and initiatives.