Security Tooling Engineer II

Stack

Responsibilities

• ▹Deploy and help maintain cloud-native security tooling in the multi-cloud environment
• ▹Contribute to infrastructure and policy management using Terraform and Terragrunt, following team standards and module patterns
• ▹Contribute configuration-as-code changes for host and service configuration, paired with the infrastructure-as-code changes needed to roll them out safely, with version control, peer reviews and automated tests
• ▹Implement cloud security configuration checks in tools that use OVAL and Rego, using regex patterns
• ▹Patch and upgrade tooling deployments on a regular cadence, following team runbooks, to maintain security, availability and reliability
• ▹Build monitoring, metrics and alerting for owned components
• ▹Help automate detection and remediation of misconfigurations in CI/CD and runtime, and reduce toil across policy workflows and operational tooling
• ▹Support RTB requests by writing targeted detection rules and running ad-hoc scans
• ▹Collaborate with Legal, Privacy and Compliance to align tool implementation with regulatory needs (FedRAMP, SOC 2, PCI, HIPAA)
• ▹Produce reports and evidence artifacts that demonstrate control effectiveness to auditors and internal stakeholders
• ▹Attend weekly stand-ups, team meetings and manager 1:1s
• ▹Document standards and playbooks and share knowledge with peers
• ▹Collaborate across global teams, including occasional shifted hours
• ▹Participate in the on-call rotation
• ▹Help foster Box culture in the Warsaw office and represent Box Poland internally and externally

Requirements

• ▹BA/BS in Computer Science or a related field
• ▹2+ years of experience with cloud-native security tooling and infrastructure-as-code in a cloud environment (Terraform preferred; exposure to Terragrunt a plus)
• ▹Working knowledge of configuration-as-code practices for host and service configuration, and comfort pairing config changes with the infrastructure-as-code changes needed to deploy them safely
• ▹Familiarity with security policy engines (e.g. OVAL, Rego) for configuration compliance checks
• ▹Working knowledge of policy-as-code practices (version control, CI/CD, reviews, unit/integration tests)
• ▹Familiarity with REST APIs and at least one major language (Python, Java, Go or Node.js); solid debugging and testing skills, able to write modular, testable and maintainable code with guidance
• ▹Comfortable debugging across multiple system layers
• ▹Interest in automation; contributes to templates and libraries that scale repetitive work
• ▹Security and privacy minded; awareness of FedRAMP, SOC 2, PCI and HIPAA, with willingness to build depth
• ▹Flexible and reliable with on-call responsibilities and occasional shifted hours in a hybrid work environment
• ▹Strong communication skills in English
• ▹Leverage AI to make faster, smarter decisions
• ▹Work from the assigned office a minimum of 3 days per week

Nice to have

• ▹Interest in DLP policy authoring (JSON/YAML, RE2 regex, dictionaries, context rules)
• ▹Experience contributing to classification, tagging and policy enforcement to prevent sensitive data exfiltration
• ▹Experience with compliance frameworks such as FedRAMP, SOC 2, PCI or HIPAA

Soft skills

What we offer

• ▹Hybrid work environment

About the company

Box (NYSE: BOX) is a leader in Intelligent Content Management. Its platform helps organizations collaborate, manage the entire content lifecycle, secure critical content and transform business workflows with enterprise AI. The company is headquartered in Redwood City, CA.