Principal Security Software Engineer, Enterprise IAM

About the role

As a Principal Security Software Engineer within the Enterprise Security team at Roblox, you will play a pivotal role in enhancing the company's security framework. Your primary focus will be on developing and implementing systems that safeguard Roblox's corporate infrastructure. Unlike traditional security roles that often rely on vendor solutions, you will be responsible for creating robust security software tailored to the unique needs of Roblox, including identity and access governance and policy enforcement mechanisms.

Key facts

What you'll do

• Design and implement identity and access management systems, ensuring seamless integration across Roblox's IAM ecosystem, which includes SSO federation, SCIM provisioning, OAuth 2.0 authorization servers, and token lifecycle management.
• Lead the development of security automation tools that enforce security policies efficiently, replacing manual processes and providing actionable insights.
• Collaborate with Corporate Engineering, DevOps, and product teams to embed security controls into enterprise systems and developer workflows, promoting a secure-by-design approach.
• Assess and enhance existing vendor platforms by evaluating commercial IAM and security tools, building custom integrations, and creating automation layers to meet Roblox's scalability requirements.
• Conduct threat modeling for authentication and authorization systems to identify vulnerabilities and improve security posture.
• Stay current with industry trends and emerging technologies related to identity and access management, ensuring that Roblox remains at the forefront of security practices.
• Mentor and guide junior engineers, fostering a culture of security awareness and best practices within the team and across the organization.
• Participate in cross-functional security initiatives, collaborating with various teams to drive security improvements and ensure compliance with industry standards.

Requirements

• A minimum of 10 years of relevant professional experience that combines software engineering and security expertise.
• In-depth knowledge of identity and authentication protocols, including OAuth 2.0, SCIM 2.0, SAML 2.0, FIDO2/WebAuthn, and SPIFFE/SPIRE.
• Experience with policy-as-code frameworks such as OPA/Rego or Cedar, and familiarity with authorization frameworks like Zanzibar/ReBAC.
• Proficiency in at least one backend programming language, such as Python, Go, or Rust.
• Strong understanding of security system design principles, including session management, audit logging, rate limiting, and secure secret storage.
• Proven experience in threat modeling and risk assessment for authentication and authorization systems.
• Familiarity with Zero Trust architecture and least-privilege access principles.

Nice to have

• Experience in developing security solutions for large-scale enterprise environments.
• Familiarity with cloud security practices and tools, particularly in AWS or Azure.
• Knowledge of compliance frameworks such as GDPR, HIPAA, or PCI-DSS.
• Experience with containerization and orchestration technologies like Docker and Kubernetes.
• Understanding of DevSecOps practices and their application in agile environments.

Skills & tools

• Proficient in security-focused programming and scripting languages.
• Familiarity with security testing tools and methodologies.
• Strong analytical and problem-solving skills, with the ability to navigate complex technical challenges.
• Excellent communication skills, capable of conveying technical concepts to non-technical stakeholders.

Practical notes

For positions based at our headquarters in San Mateo, CA, the starting base salary for this role ranges from $385,050 to $443,200 annually. The actual salary may vary based on factors such as professional experience, background, and market demand. All full-time employees are eligible for equity compensation and a comprehensive benefits package.

Roblox promotes a diverse and inclusive workplace, providing equal employment opportunities to all applicants. We do not discriminate based on race, color, religion, gender, age, disability, or any other characteristic protected by law. Reasonable accommodations are available for candidates with disabilities or religious beliefs during the recruitment process.

Please note that for this position, the company may not be able to hire candidates requiring specific U.S. work authorizations or support H-1B sponsorship at this time.

About the company

An online space lets people build and play games. Founded long ago by two creators, it grew into a shared world opened to everyone in the mid 2000s. Now reaching millions each day, it hosts games made by its users. A large share of young American children under sixteen are monthly players here. High daily activity shows a lasting community where creativity and shared play remain central.