D
Security Engineer, IAM
Contract type
Ongoing
Work mode
Remote · Canada
Experience
Senior · 5+ years
Job description
Security Engineer role at Dropbox focused on building and operating identity and access management (IAM) controls across cloud and on-premises infrastructure, including secure access for AI agents and non-human actors. The role combines security engineering and automation to enforce least privilege and simplify identity lifecycle management.
At a glance
- Employment
- Full-time · Employee (employment agreement)
- Work mode
- Remote · Canada
- Pay
- CAD 191,300 – 258,700 / year
What you'll do
- Design, deploy, and operate IAM controls across Dropbox's cloud and on-premises infrastructure.
- Design and implement secure identity, authentication, and authorization controls for AI agents and other non-human actors.
- Implement least-privilege access using RBAC, ABAC, permission boundaries, service control policies, and just-in-time access.
- Design secure integrations using SAML, OAuth 2.1, OpenID Connect, SCIM, and SPIFFE/SPIRE.
- Automate identity lifecycle processes to ensure access is granted, modified, and revoked promptly.
- Develop identity guardrails using infrastructure-as-code and policy-as-code.
- Build monitoring and alerting for anomalous authentication, privilege escalation, credential misuse, and unauthorized access.
- Partner with Incident Response to investigate identity-related incidents and rapidly revoke compromised access.
- Conduct security reviews and threat modeling for new identity architectures and integrations.
- Maintain IAM services with strong reliability, documentation, operational ownership, and on-call support.
What we're looking for
- 5+ years of security engineering experience, including substantial IAM or identity-security experience
- Hands-on experience with Okta, Okta for AI Agents and Sailpoint, or comparable technologies
- Strong understanding of authentication, authorization, least privilege, zero trust, and identity lifecycle management
- Experience with SAML, OAuth 2.0/2.1, OpenID Connect, SCIM, and MFA
- Experience designing RBAC or ABAC authorization models
- Experience securing human and non-human identities, including services, workloads, automation, and CI/CD systems
- Experience with agentic frameworks and MCP tool integration
- Experience implementing access reviews, privileged-access controls, and joiner/mover/leaver workflows
- Proficiency in at least one programming or scripting language, such as Python, Go, Java, Ruby, or Bash
- Experience with infrastructure-as-code, policy-as-code, APIs, and security automation
- Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience
Nice to have
- Experience with workload identity technologies such as SPIFFE/SPIRE, Kubernetes service accounts, or cloud workload identity.
- Experience securing identities and authorization for AI agents and other autonomous systems.
- Experience with just-in-time access, zero-standing-privilege, or privileged-access management platforms.
- Familiarity with identity threat detection and response.
- Experience building IAM controls for multi-account cloud environments.
- Familiarity with NIST SP 800-63, NIST SP 800-207, CIS benchmarks, and relevant identity-security guidance.
- Experience supporting compliance programs such as SOC 2, ISO 27001, or FedRAMP.
- Security certifications such as CISSP, CCSP, or equivalent.
- Contributions to the identity or security community through open-source projects, publications, or conferences.
Apply
Direct apply at Dropbox
Opens the job posting at Dropbox
About Dropbox
Mission
To integrate security seamlessly into Dropbox, empowering confident collaboration.
Key facts
- Trusted by millions