At a Glance
Box’s Security team protects our products, infrastructure, and data from ever-evolving threats. We enable secure innovation by embedding trust into every layer of development and operations. Join us to build defenses that scale, systems that detect, and protections our customers rely on every day.
The Application Security team plays a crucial role in safeguarding our software products. They focus on automating and integrating key aspects of secure development to fortify all of our applications. Their continuous efforts contribute to maintaining a high standard of data protection for Box’s customers.
The Business Operations and Security Strategy team safeguards Boxers and represents the Global Security Office externally. They manage security training, human risk, lead content protection efforts, and bridge Box and external customers for sales engagements, escalations, and investigations.
The Corporate Security team is at the forefront of protecting employee data on a global scale. With their world-class expertise, they design and implement robust security measures to safeguard Box’s corporate assets in an ever-evolving threat landscape.
The Production Security team includes our Security Tooling, Platform Security, Security Engineering, and Cloud Security teams. They are pivotal in driving various initiatives to harden our production environment, deploy and scale defenses for GCP security efforts and production security activities.
The Security Operations organization includes our Threat Operations, Red Team and Incident Response teams. Their overall goal is to establish a robust security posture, enhance incident detection and response capabilities, minimize the impact of security incidents, and ensure the protection of Box and our customers’ critical assets.
Box TPMs drive alignment and execution for successful delivery of strategic, cross-functional and complex technical programs across Box. They do this by leading initiatives to improve delivery life cycle, improve time-to-market and increase efficiency.
Hear from Dylan Capener, Senior Director of Security Engineering, as they share what makes Box a uniquely rewarding place to grow, lead, and protect what matters most.
We're not just shaping the future of work — we're living it everyday. Join a team where collaboration, innovation, and growth are more than buzzwords.
Your company uses and produces valuable content each day. Employee personal information, client data, and product brainstorms are all examples of content your company needs to succeed. Protecting all this information should be your business’s top priority
Read moreAcross all sectors of IT, projects are often managed through a lifecycle model, where a product goes through a cycle of improvement and upkeep with no endpoint. This is true for information security as much as any other IT sector.
Read moreData breaches are on pace to set a new record high in 2023, according to the Identity Theft Resource Center. With cyberattacks on the rise, you need to strengthen your defenses. That’s where a secure vault comes in handy.
Read moreStay in the loop by joining our talent community. Be the first to hear about new opportunities and life at Box.
Join our talent communityWe care about your privacy
Source: Box careers · View original posting
Box, Inc. is a leading independent cloud content management platform that focuses on secure storage, sharing, collaboration, and workflow automation for enterprise content. Founded in 2005, Box transitioned from a consumer-focused service to an enterprise solution, emphasizing security and compliance. The company is headquartered in Redwood City, California, and has seen significant growth since its inception. Box offers a SaaS platform that manages the full content lifecycle. Its features include cloud storage and file sharing, collaboration tools for real-time editing, and advanced security measures tailored for enterprises. The platform also supports integrations and automation through APIs, enhancing its functionality with features like AI and e-signatures. Box serves a variety of industries, including financial services, healthcare, media, technology, and government, catering to businesses of all sizes.
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
Security Philosophy
“Stated AppSec Mission: "At Box, security and compliance are part of our DNA."– Box Trust Center (https://www.box.com/trust), Trust Center , ⚠️ "Application security: Protects devices and software programs from threats"– Blog: What is information security (https://blog.box.com/what-is-information-security), Blog , Developer Enablement vs. Gatekeeping: "Ship MVPs and iterate on security automation"– Senior Manager, Product Security Engineering (Job ID: 7336934), Job Posting , ⚠️ "embed requirements into patterns, platforms, and CI/CD/SAST/DAST workflows."– Senior Security Engineer (ZipRecruiter posting referencing Box job), Job Posting , Risk Philosophy: "Box has an established Enterprise Risk and Resiliency program"– Box Trust Center (https://www.box.com/trust), Trust Center , ⚠️ "Drive a breaker–builder approach"– Senior Manager, Product Security Engineering (Job ID: 7336934), Job Posting , ⚠️ Stated Pain Points or Goals (Verbatim): "Build capabilities, modules and mechanisms to eliminate classes of vulnerabilities"– Senior Security Engineer (ZipRecruiter posting referencing Box job), Job Posting , "Support and triage submissions for Bug Bounty and VDP programs"– Senior Security Engineer (ZipRecruiter posting referencing Box job), Job Posting , Gaps & Contradictions: - Reporting chain for AppSec (who AppSec reports to: CISO/CTO/etc”
Security Team
Key Initiatives
Security Champions Program: Status: Evidence Found "Support engineers and security champions"– Senior Security Engineer (ZipRecruiter posting referencing Box job), Job Posting , (Interpretation note: the phrase is sourced from a Box job posting indicating the existence of "security champions"support responsibilities.) "Shift Left"in Practice: "Secure software development is of utmost importance to the Software Development Lifecycle (SDLC) at Box."– Box Trust Center (https://www.box.com/trust), Trust Center , ⚠️ "embed requirements into patterns, platforms, and CI/CD/SAST/DAST workflows."– Senior Security Engineer (ZipRecruiter posting referencing Box job), Job Posting , "Ship MVPs and iterate on security automation"– Senior Manager, Product Security Engineering (Job ID: 7336934), Job Posting , ⚠️ Vulnerability Management Process (Intake, Triage, Remediation): Intake: "Box performs authenticated and unauthenticated network vulnerability scans of our production environment"– Box Trust Center (https://www.box.com/trust), Trust Center , ⚠️ Remediation SLAs: "We remediate our critical-severity findings within 48 hours"– Box Trust Center (https://www.box.com/trust), Trust Center , ⚠️ Penetration Testing: "Annual penetration testing is performed on Box's Web Application, Mobile Application, APIs"– Box Trust Center (https://www.box.com/trust), Trust Center , ⚠️ Bug Bounty / VDP: "Support and triage submissions for Bug Bounty and VDP programs"– Senior Security Engineer (ZipRecruiter posting referencing Box job), Job Posting , Secure SDLC Artifacts: "Threat modeling"– Box Trust Center (https://www.box.com/trust), Trust Center , ⚠️ "Static code analysis"– Box Trust Center (https://www.box.com/trust), Trust Center , ⚠️ "Dynamic code analysis"– Box Trust Center (https://www.box.com/trust), Trust Center , ⚠️ "security reviews for all major features"/ "security, legal and compliance reviews for critical products and services"– Box Trust Center (https://www.box.com/trust), Trust Center , ⚠️ Recent Initiatives (Last 6 Months): - No explicit, AppSec-specific program announcements or tool rollouts dated within the last six months were found in public Box pages or blogs
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
Interested in this role?
Apply on Box's site