Joblaze summary

In this role, the Application Security Engineer at Dropbox focuses on enhancing security practices by developing tools and frameworks that integrate seamlessly into the software development lifecycle. Key skills include experience with security automation, familiarity with modern tech stacks, and a solid understanding of common vulnerabilities. This position is ideal for someone with over four years in application security, capable of collaborating across various teams while supporting secure development initiatives. The role also involves participating in on-call rotations, reflecting the team's commitment to maintaining robust security protocols.

Joblaze insights

Listed today — first seen on Joblaze November 14, 2026. Last confirmed on Dropbox's careers page November 14, 2026.
This exact title is also open at 1 other location at Dropbox: Mexico.
Salary band is in line with the typical range for Security roles (median ~$170,000).
Starts above 73% of 11 comparable mid security roles in United States that list security we track (median $125,000 across 8 companies). See security salary trends
security appears in 8.5% of 211 comparable mid security roles in United States; Bug Bounty appears in 0.9% of 211 comparable mid security roles in United States.

Quick facts

Is the Application Security Engineer role remote?: Yes — Dropbox lists this as a fully remote position.
What's the salary range?: Dropbox lists $172,000–$261,900 for this role.
How much experience is required?: At least 4 years of relevant experience for this Application Security Engineer role.
What's the tech stack?: Joblaze extracted these technologies from the posting: Automation, Bug Bounty, CI/CD, Generative AI, Machine Learning, Microservices.
What seniority level is this role?: Dropbox targets mid-level candidates for this position.
Is this full-time or contract?: Full-time for this Application Security Engineer role at Dropbox.

From the original posting

Role Description

As part of the Product Security Engineering team, you’ll focus on reducing risk at scale by building the security infrastructure, automation, and tooling that empowers engineers to ship secure products with confidence. We work closely with engineering and product teams throughout the software development lifecycle (SDLC), embedding secure-by-default practices and delivering scalable solutions.

Product Security Engineers create impact by implementing security tooling, writing custom security rules, and building frameworks that address broad classes of vulnerabilities. In addition to proactive development, we support teams through threat modeling, documentation, and education to uplift security culture across Dropbox.

Our Engineering Career Framework is viewable by anyone outside the company and describes what’s expected for our engineers at each of our career levels. Check out our blog post on this topic and more here.

Responsibilities

Build and maintain security tools, automation, and libraries to enable secure-by-default development across engineering teams.
Design and implement custom security rules (e.g., Semgrep, CodeQL) to detect and prevent common and emerging vulnerability patterns.
Act as a subject matter expert on application security across web, mobile, and desktop environments.
Improve and scale the Secure Development Lifecycle (SDLC) by integrating tools, checks, and processes into engineering workflows.
Perform targeted code reviews, and develop follow-up tooling or controls to prevent regressions.
Collaborate cross-functionally with engineering, product, GRC, and AI/ML teams to proactively address security risks, especially in fast-moving and emerging tech areas.

Many teams at Dropbox run Services with on-call rotations, which entails being available for calls during both core and non-core business hours. If a team has an on-call rotation, all engineers on the team are expected to participate in the rotation as part of their employment. Applicants are encouraged to ask for more details of the rotations to which the applicant is applying.

Requirements

4+ years of experience in application security or security engineering roles.
Hands-on experience building or using security automation tools to improve developer workflows and product security.
Demonstrated ability to work across the SDLC, including supporting and interpreting findings from penetration tests and bug bounty reports.
Familiarity with modern tech stacks, including microservices, CI/CD pipelines, and cloud-native environments.
Solid understanding of common vulnerability classes (e.g., injection, XSS, authN/authZ issues) and practical mitigation strategies.
Comfortable working in cross-functional environments and supporting multiple product and engineering teams simultaneously.
Experience participating in or supporting incident response or security on-call rotations is a plus

Preferred Qualifications

Experience in application security engineering, with a strong focus on security tooling and automation.
Demonstrated ability to write and maintain custom security rules and integrate them into developer workflows.
Experience with machine learning systems, particularly generative AI, and the ability to support secure development in AI-driven products.
Experience developing internal libraries or frameworks that reduce or eliminate entire classes of vulnerabilities.
Proficient in software development, with experience contributing production-level code in one or more modern languages.
Familiarity with securing diverse application types, including web, mobile, and native platforms.
Experience with data security, including tooling for data protection, access control, and encryption.
Strong communication skills and ability to build trusted partnerships with cross-functional teams.

Durable Skills

Compensation

US Zone 1

This role is not available in Zone 1

US Zone 2

$193,500—$261,900 USD

US Zone 3

$172,000—$232,800 USD

Standard company text repeated across Dropbox's postings is omitted here.

Application Security Engineer