Application Security - Design Reviews Threat Modelling
作为产品安全架构团队的一部分，你将通过与软件开发生命周期 (SDLC) 的工程和产品团队合作帮助减少 Dropbox 的安全风险。我们的团队专注于安全威胁建模和咨询。我们密切地与产品和基础设施团队合作，在设计过程中早期识别安全风险，提供实用的安全指导，并帮助团队建立安全系统。我们还开发工具，文档和自动化，以提高 Dropbox 内的安全评价效率和可扩展性。负责人 · 在安全设计审查和威胁建模练习中参与新产品，服务和平台能力。· 与工程团队合作确定安全风险并建议在设计和开发过程中采取实际减轻措施。· 为产品和工程团队担任安全顾问，回答安全问题并提供安全实施模式的指导。· 审查应用程序和系统架构，技术设计，数据流量和部署模型以确定安全风险并建议安全的设计模式 · 与工程团队合作开发人工智能和机器学习功能以识别新兴的安全风险和推安全实施模式。·帮助维护和改善安全标准，指导，参考架构和内部文档。· 开发或增强提高威胁建模，安全评估和风险评估过程效率的工具和自动化。· 与其他产品安全工程师合作，进行应用程序安全评估并调查开发过程中发现的安全问题。·通过文档，办公时间，研讨会或安全意识倡议为开发人员提供教育工作。· 在发现应用程序安全问题的时支持安全事件调查和根源分析。要求所需资格。·可在太平洋标准时间 (PST) 11:00点之前工作。· 5年以上应用程序安全，产品安全或相关领域经验。·强有力的了解常见的应用程序安全漏洞 （OWASP Top 10,API Security,身份证）.
查看英文原文
This is a remote position.
As part of the Product Security Architecture team, you'll help reduce security risk across Dropbox by partnering with engineering and product teams throughout the software development lifecycle (SDLC).
Our team focuses on security threat modeling, and consulting. We work closely with product and infrastructure teams to identify security risks early in the design process, provide practical security guidance, and help teams build secure systems. We also develop tooling, documentation, and automation that improve the efficiency and scalability of security reviews across Dropbox.
This role is ideal for a security engineer who enjoys solving technical problems, collaborating with engineers, and helping teams make informed security decisions.
Responsibilities
- Participate in security design reviews and threat modeling exercises for new products, services, and platform capabilities.
- Partner with engineering teams to identify security risks and recommend practical mitigations during the design and development process.
- Serve as a security consultant for product and engineering teams, answering security questions and providing guidance on secure implementation patterns.
- Review application and system architectures, technical designs, data flows, and deployment models to identify security risks and recommend secure design patterns
- Partner with engineering teams developing AI and machine learning features to identify emerging security risks and recommend secure implementation patterns.
- Help maintain and improve security standards, guidance, reference architectures, and internal documentation.
- Develop or enhance tooling and automation that improve the efficiency of threat modeling, security reviews, and risk assessment processes.
- Collaborate with other Product Security engineers to perform application security assessments and investigate security concerns identified during development.
- Contribute to developer education efforts through documentation, office hours, workshops, or security awareness initiatives.
- Support security incident investigations and root cause analysis when application security issues are discovered.
Requirements
Required Qualifications
- Available to work until 11:00AM Pacific Standard Time (PST).
- 5+ years of experience in Application Security, Product Security, or a related field.
- Strong understanding of common application security vulnerabilities (OWASP Top 10, API Security, authentication, authorization, secrets management, cryptography, etc.).
- Experience participating in security reviews, threat modeling exercises, architecture discussions, or application security assessments.
- Strong technical writing skills and experience creating documentation and guidelines.
- Strong communication skills and ability to explain security concepts to engineers with varying levels of security expertise.
- Experience working collaboratively with software engineering teams to identify and address security risks.
- Familiarity with cloud platforms and modern application architectures (AWS preferred).
- Ability to assess risk, prioritize issues, and provide practical security recommendations.
- Experience reading and understanding source code in one or more modern programming languages.
- Experience building scripts, tools, or automation to improve engineering or security workflows.
Originally posted on Himalayas