Senior Security Engineer, AI Security

This is a fully remote position, open to applicants in Canada.

📋 Description

• Define how Dropbox secures its AI systems and autonomous workflows.

• Create, implement, and manage security controls at the infrastructure level for Dropbox's AI and autonomous infrastructure, which includes cloud infrastructure, Kubernetes, and data storage solutions.

• Develop and execute secure authentication, authorization, and networking strategies for AI agents and other non-human entities.

• Oversee the security implementation for the safe utilization of AI tools and governance.

• Sustain and enhance the security of Dropbox's infrastructure to safeguard customer data.

• Evaluate current and future infrastructure stacks from a security standpoint, offering hardening strategies and recommendations.

• Deploy, construct, and/or manage security infrastructure solutions for both on-premises and cloud environments at Dropbox.

• Work collaboratively with cross-functional teams and spearhead security initiatives to shape product decisions and elevate the security posture.

• Engage in on-call rotations as required, ensuring availability during both core and non-core business hours.

⛳️ Requirements

• A minimum of 8 years of experience in security, showcasing significant contributions to security strategies.

• Proven experience in securing agentic AI systems, with practical implementation of security controls addressing AI-specific vulnerabilities such as prompt injection, data or model poisoning, and AI supply-chain risks.

• Background in designing and implementing identity and authorization for non-human workloads and agents utilizing modern frameworks like SPIFFE/SPIRE, OAuth 2.1, OIDC, or equivalent cloud provider solutions.

• Experience in applying policy-as-code, infrastructure-as-code, and security automation across cloud and AI platforms.

• Familiarity with agentic frameworks and integration of MCP tools.

• Knowledge of cloud security technologies for Amazon Web Services (AWS), Google Cloud Platform (GCP), or Microsoft Azure.

• Proficient in one or more scripting or high-level programming languages for task automation, data manipulation, or building small systems, such as Bash, Python, Go, Rust, Ruby, NodeJS, C/C++, or Java.

• A Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience, along with coding proficiency.

• Preferred: Experience in securing systems based on MCP or similar AI agent and tool protocols.

• Preferred: Experience with multi-agent security controls like trust boundaries, signed inter-agent messaging, and circuit breakers.

• Preferred: Familiarity with NIST AI RMF, NIST SP 800-218A, OWASP LLM, and guidance on agentic security.

• Preferred: Experience with Kubernetes and container security.

• Preferred: Familiarity with security tools such as Teleport, CrowdStrike, Proofpoint, IPS/IDS, SIEM, or SOAR.

• Preferred: Relevant certifications like CISSP, CISM, or equivalent.

• Preferred: Active participation in security community events, conferences, or publications.

• Participation in on-call rotations as needed.

🏝️ Benefits

• Comprehensive health, dental, and vision plans.

• Generous paid time off and holiday leave.

• Opportunities for professional development and career advancement.

• Flexible work arrangements to promote work-life balance.