Requirements

BA/BS in Computer Science or related field.
2+ years of experience with cloud-native security tooling and infrastructure-as-code (Terraform preferred; exposure to Terragrunt a plus) in a cloud environment.
Working knowledge of configuration-as-code practices for host and service configuration, paired with infrastructure-as-code deployment.
Familiarity with security policy engines (e.g., OVAL, Rego) for configuration compliance checks.
Experience with policy-as-code practices including version control, CI/CD, reviews, and automated testing.
Familiar with REST APIs and at least one major programming language (Python, Java, Go, or Node.js); capable of writing modular, testable, maintainable code.
Strong debugging skills across multiple system layers.
Interest in automation and contributing to scalable templates and libraries.
Security and privacy awareness with knowledge or willingness to deepen understanding of FedRAMP, SOC 2, PCI, and HIPAA.
Collaborative communicator, team-oriented, and proactive in sharing information and raising roadblocks.
Growth mindset, openness to feedback, and motivation for professional development.
Flexible and reliable with on-call responsibilities and occasional shifted hours in a hybrid work environment.
Strong communication skills in English.

Nice to Haves

Interest in Data Loss Prevention (DLP) policy authoring (JSON/YAML, RE2 regex, dictionaries, context rules).
Experience with classification, tagging, and policy enforcement to prevent sensitive data exfiltration.
Experience with compliance frameworks such as FedRAMP, SOC 2, PCI, or HIPAA.

Deploying and maintaining cloud-native security tooling in a multi-cloud environment.
Contributing to infrastructure and policy management with Terraform and Terragrunt following team standards.
Implementing configuration-as-code changes for host and service configuration alongside infrastructure-as-code changes with proper version control, peer reviews, and automated tests.
Implementing cloud security configuration checks using OVAL, Rego, and regex patterns.
Regularly patching and upgrading tooling deployments to maintain security, availability, and reliability.
Building monitoring, metrics, and alerting systems to support risk reduction and operational excellence.
Automating detection and remediation of misconfigurations in CI/CD and runtime to reduce toil.
Supporting RTB requests with targeted detection rules and ad-hoc scans.
Collaborating with Legal, Privacy, and Compliance to align tooling with regulatory requirements like FedRAMP, SOC 2, PCI, HIPAA.
Producing reports and evidence for auditors and internal stakeholders.
Participating in weekly stand-ups, team meetings, and manager one-on-ones.
Working collaboratively with engineers and teams globally, including occasional shifted hours.
Contributing to developing and fostering company culture in the Warsaw office and representing Box Poland internally and externally.
Documenting standards, playbooks, and sharing best practices with peers.
Participating in on-call rotation and responding promptly to any issues.

Hybrid work environment with an expectation to work from assigned office at least 3 days per week.
Company culture valuing community, collaboration, diversity, and inclusion.
Opportunity to work at a leading AI-first company driving innovation in content management.
Supportive environment encouraging growth, learning, and professional development.