Security Tooling Engineer II

Box (NYSE:BOX) is the leader in Intelligent Content Management, founded in 2005. The company's platform enables organizations to fuel collaboration, manage the entire content lifecycle, secure critical content, and transform business workflows with enterprise AI. Box serves global organizations including JLL, Morgan Stanley, and Nationwide and is headquartered in Redwood City, CA, with offices worldwide.

• BA/BS in Computer Science or related field.
• Minimum 2 years of experience with cloud-native security tooling and infrastructure-as-code, preferably with Terraform and experience with Terragrunt.
• Working knowledge of configuration-as-code practices integrated with infrastructure-as-code deployments.
• Familiarity with security policy engines such as OVAL and Rego.
• Experience with policy-as-code practices including version control, CI/CD, reviews, and testing.
• Proficient in at least one major programming language: Python, Java, Go, or Node.js; strong debugging and testing skills.
• Comfortable debugging across multiple system layers.
• Interest in automation and scaling repetitive tasks via templates and libraries.
• Security and privacy awareness, including frameworks FedRAMP, SOC 2, PCI, and HIPAA, with willingness to deepen expertise.
• Effective collaborative communication and ability to raise blockers proactively.
• Team-oriented with active participation in discussions and projects.
• Growth mindset and curiosity about industry trends and tools.
• Flexibility and reliability for on-call duties and shift hours in a hybrid work setting.
• Strong English communication skills.

Nice to have:

• Experience with Data Loss Prevention (DLP) policy authoring and enforcement.
• Experience with compliance frameworks and security policy enforcement.

• Deploy and maintain cloud-native security tooling in a multi-cloud environment.
• Contribute to infrastructure and policy management using Terraform and Terragrunt.
• Implement configuration-as-code changes for host and service configuration paired with infrastructure-as-code safely.
• Perform security configuration checks using tools with OVAL and Rego, leveraging regex patterns.
• Patch and upgrade tooling regularly to maintain security, availability, and reliability.
• Build monitoring, metrics, and alerting for owned security components.
• Automate detection and remediation of misconfigurations in CI/CD and runtime environments.
• Support real-time blocking (RTB) requests via targeted detection rules and ad-hoc scans.
• Collaborate with Legal, Privacy, and Compliance teams to align tools with regulatory frameworks like FedRAMP, SOC 2, PCI, and HIPAA.
• Produce reports and evidence demonstrating control effectiveness to auditors and stakeholders.
• Participate in on-call rotations and handle incident triage.
• Document standards and share knowledge and best practices within the team.
• Engage in team meetings, stand-ups, and contribute to the Box culture in Warsaw.
• Collaborate across global teams, including working occasional shifted hours for cross-time-zone projects.

Nice to have:

• Interest and experience in DLP policy authoring using JSON/YAML, RE2 regex, dictionaries, and context rules.
• Experience contributing to classification, tagging, and policy enforcement to prevent sensitive data exfiltration.
• Familiarity with security policy engines, and cloud-native security tooling frameworks.