security engineer

Box is a leader in Intelligent Content Management that enables organizations to fuel collaboration, manage content lifecycles, secure critical information, and transform business workflows with enterprise AI. Founded in 2005, the company simplifies work for global organizations and maintains headquarters in Redwood City, California, with offices across the United States, Europe, and Asia.

• Contribute to a roadmap that scales security capabilities across platform and product surfaces;
• Ship MVPs and iterate on security automation, including supply chain security, SDLC agents/controls, and developer-first guardrails;
• Partner with the Assurance & Architecture Team and cross-functional teams to embed security into workflows and tooling;
• Identify attack paths, validate with experimentation, and operationalize secure product development at scale;
• Establish team operating mechanisms including prioritization, planning, metrics, and post-launch learning;
• Define and track KPIs and KRIs related to risk reduction, coverage, and developer experience;
• Represent the team internally and in the community to foster a culture of learning and inclusion.

• Strong security engineering foundation with hands-on experience in at least two of: DevSecOps automation, software supply chain security, SDLC controls/agents, fuzzing, or application security tooling;
• Development skills in Python, Go, Java, or TypeScript with a track record of building production systems;
• Builder mindset with the ability to turn ambiguous risk areas into roadmaps and measurable outcomes;
• Ability to influence without authority and partner across Product, Engineering, and Cloud/SRE teams;
• Data-driven approach to decision-making and iteration;
• Fluent English for aligning global stakeholders;
• Nice to have: Experience with SaaS at scale, developer platform/tooling, cloud-native environments, contributions to open source or security communities, and familiarity with CI/CD, container registries, policy engines, SAST/DAST, or package managers.

• Office role with in-person collaboration required at least 3 days per week.