Application Security - Design Reviews Threat Modelling
Free to start · No card · 5 credits the moment you sign up
Job description
This is a remote position.
As part of the Product Security Architecture team, you'll help reduce security risk across Dropbox by partnering with engineering and product teams throughout the software development lifecycle (SDLC).
Our team focuses on security threat modeling, and consulting. We work closely with product and infrastructure teams to identify security risks early in the design process, provide practical security guidance, and help teams build secure systems. We also develop tooling, documentation, and automation that improve the efficiency and scalability of security reviews across Dropbox.
This role is ideal for a security engineer who enjoys solving technical problems, collaborating with engineers, and helping teams make informed security decisions.
Responsibilities
- Participate in security design reviews and threat modeling exercises for new products, services, and platform capabilities.
- Partner with engineering teams to identify security risks and recommend practical mitigations during the design and development process.
- Serve as a security consultant for product and engineering teams, answering security questions and providing guidance on secure implementation patterns.
- Review application and system architectures, technical designs, data flows, and deployment models to identify security risks and recommend secure design patterns
- Partner with engineering teams developing AI and machine learning features to identify emerging security risks and recommend secure implementation patterns.
- Help maintain and improve security standards, guidance, reference architectures, and internal documentation.
- Develop or enhance tooling and automation that improve the efficiency of threat modeling, security reviews, and risk assessment processes.
- Collaborate with other Product Security engineers to perform application security assessments and investigate security concerns identified during development.
- Contribute to developer education efforts through documentation, office hours, workshops, or security awareness initiatives.
- Support security incident investigations and root cause analysis when application security issues are discovered.
Requirements
Required Qualifications
- Available to work until 11:00AM Pacific Standard Time (PST).
- 5+ years of experience in Application Security, Product Security, or a related field.
- Strong understanding of common application security vulnerabilities (OWASP Top 10, API Security, authentication, authorization, secrets management, cryptography, etc.).
- Experience participating in security reviews, threat modeling exercises, architecture discussions, or application security assessments.
- Strong technical writing skills and experience creating documentation and guidelines.
- Strong communication skills and ability to explain security concepts to engineers with varying levels of security expertise.
- Experience working collaboratively with software engineering teams to identify and address security risks.
- Familiarity with cloud platforms and modern application architectures (AWS preferred).
- Ability to assess risk, prioritize issues, and provide practical security recommendations.
- Experience reading and understanding source code in one or more modern programming languages.
- Experience building scripts, tools, or automation to improve engineering or security workflows.
Originally posted on Himalayas
Prepare your application
Use the description above to assess your fit for SRM Technologies. This checklist is guidance from Resumize, rather than additional requirements from the employer. Imported listings can be shortened or change after collection, so confirm the complete description and current availability before sending an application.
Match requirements to evidence
Identify the responsibilities and skills the employer explicitly names. For each important requirement, choose one example from your work, education, training, or projects. Explain what you did, how you did it, and what changed as a result. Include a measurable outcome when you can support it. If you lack a requirement, describe related experience accurately instead of adding an unfamiliar skill to your resume.
Put the most relevant examples near the top of your resume. Keep job titles, dates, qualifications, and contact details consistent across your application materials. Use the employer’s terminology when it describes your experience accurately; a copied list of keywords does not explain your contribution. A short, specific bullet is easier to review than a paragraph that mixes several unrelated duties.
Check the working arrangement
Confirm the location, schedule, employment type, and any eligibility requirements on the employer’s site. A remote label does not establish worldwide eligibility or flexible hours. If compensation, benefits, equipment, travel, or contract duration are missing from this listing, write down your questions for the recruiter. Do not assume details from another opening at the same company apply to this role.
Review before submitting
Follow the employer’s requested file format and application instructions. Open your exported resume and check that its text is selectable, its sections read in order, and its links work. Proofread names, dates, and contact information. Share confidential work samples only when you have permission, and use an anonymized example when necessary.
Submit through a trusted employer or recruiting destination. If the original listing has disappeared, search the employer’s careers page for the title rather than assuming the vacancy remains open. Save the application date, job reference, and the version of your resume you sent. Those details help you prepare for a later conversation and avoid submitting conflicting information through several job boards.
Review your resume for writing and readability feedback, or browse other openings if this opportunity is unavailable.