Security Engineer, IAM

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, implement, and manage IAM controls across Dropbox’s cloud and on-premises environments.

• Create and enforce secure identity, authentication, and authorization protocols for AI agents and other non-human entities.

• Execute least-privilege access strategies utilizing RBAC, ABAC, permission boundaries, service control policies, and just-in-time access.

• Develop secure integrations leveraging SAML, OAuth 2.1, OpenID Connect, SCIM, and SPIFFE/SPIRE.

• Automate identity lifecycle procedures to ensure timely granting, modification, and revocation of access.

• Establish identity guardrails through infrastructure-as-code and policy-as-code practices.

• Create monitoring and alerting systems for detecting anomalous authentication, privilege escalation, credential misuse, and unauthorized access.

• Collaborate with Incident Response teams to investigate identity-related incidents and swiftly revoke compromised access.

• Perform security assessments and threat modeling for new identity architectures and integrations.

• Uphold IAM services with excellent reliability, comprehensive documentation, operational ownership, and on-call support.

• Collaborate closely with teams in Infrastructure, Corp Engineering, Developer Platform, and Incident Response.

⛳️ Requirements

• Over 5 years of experience in security engineering, with a significant focus on IAM or identity security.

• Practical experience with Okta, Okta for AI Agents, SailPoint, or similar technologies.

• Strong knowledge of authentication, authorization, least privilege, zero trust principles, and identity lifecycle management.

• Familiarity with SAML, OAuth 2.0/2.1, OpenID Connect, SCIM, and multi-factor authentication (MFA).

• Experience in designing RBAC or ABAC authorization frameworks.

• Proven track record in securing both human and non-human identities, encompassing services, workloads, automation, and CI/CD systems.

• Experience with agentic frameworks and integration of MCP tools.

• Demonstrated ability to implement access reviews, privileged access controls, and joiner/mover/leaver workflows.

• Proficient in at least one programming or scripting language, such as Python, Go, Java, Ruby, or Bash.

• Experience with infrastructure-as-code, policy-as-code, APIs, and security automation.

• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent hands-on experience.

🏝️ Benefits

• On-call support and engagement in on-call rotations, including availability during both core and non-core business hours.

• Compensation range varies by US zone: US Zone 2 $193,500–$261,900 USD; US Zone 3 $172,000–$232,800 USD.