Security Tooling Engineer II

Box is a leader in Intelligent Content Management, providing a platform that enables collaboration, content lifecycle management, content security, and business workflow transformation with enterprise AI. Founded in 2005, it serves global organizations such as JLL, Morgan Stanley, and Nationwide. Box is headquartered in Redwood City, CA, with offices in the United States, Europe, and Asia, including Warsaw, Poland.

• BA/BS in Computer Science or related field.
• 2+ years experience with cloud-native security tooling and infrastructure-as-code, preferably Terraform, with some exposure to Terragrunt.
• Knowledge of configuration-as-code practices for host and service configuration paired with infrastructure-as-code deployment.
• Familiarity with security policy engines such as OVAL and Rego for configuration compliance.
• Experience with policy-as-code including version control, CI/CD, reviews, and unit/integration testing.
• Familiar with REST APIs and proficiency in at least one major programming language: Python, Java, Go, or Node.js.
• Strong debugging and testing skills; able to write modular, testable, and maintainable code.
• Comfortable debugging across multiple system layers.
• Interest in automation and creating scalable templates and libraries.
• Security and privacy minded with awareness of compliance frameworks including FedRAMP, SOC 2, PCI, and HIPAA.
• Collaborative communication skills with ability to share findings and raise issues early.
• Team-oriented with active contribution and stakeholder communication.
• Growth mindset motivated to learn industry trends and expand expertise.
• Interest in data loss prevention (DLP) policy authoring using JSON/YAML, RE2 regex, dictionaries, and context rules.
• Flexible and reliable with on-call responsibilities and occasional shifted hours.
• Strong English communication skills.

Nice to have:

• Experience contributing to classification, tagging, and policy enforcement to prevent sensitive data exfiltration.
• Experience with compliance frameworks such as FedRAMP, SOC 2, PCI, or HIPAA.

• Deploy and maintain cloud-native security tooling in a multi-cloud environment.
• Contribute to infrastructure and policy management using Terraform and Terragrunt following team standards and module patterns.
• Implement configuration-as-code changes for host and service configuration with version control, peer reviews, and automated tests.
• Implement cloud security configuration checks using tools with OVAL and Rego, employing regex patterns.
• Patch and upgrade tooling deployments regularly according to team runbooks to maintain security, availability, and reliability.
• Build monitoring, metrics, and alerting for owned components to support risk reduction and operational excellence.
• Automate detection and remediation of misconfigurations in CI/CD and runtime environments.
• Support run-the-business (RTB) requests by writing detection rules and running ad-hoc scans.
• Collaborate with Legal, Privacy, and Compliance teams to align tools with regulatory requirements (FedRAMP, SOC 2, PCI, HIPAA).
• Produce reports and evidence for auditors and stakeholders demonstrating control effectiveness.
• Participate in weekly stand-ups, team meetings, and 1:1s.
• Work collaboratively across teams and contribute to team culture in the Warsaw office.
• Represent Box Poland internally and externally.
• Document standards and playbooks, sharing knowledge and best practices.
• Collaborate across global teams including occasional shifted hours for cross-time-zone projects.
• Participate in on-call rotation and respond to operational issues while on-call.

Boxers are expected to work from their assigned office a minimum of 3 days per week in Warsaw. The role includes participation in on-call rotation and occasional shifted hours for cross-time-zone projects. Box is an equal opportunity employer that values diversity and does not discriminate based on protected characteristics under applicable legislation.