Senior Security Software Engineer, Application Security

About the role

As a Senior Security Software Engineer specializing in Application Security at Roblox, you will be at the forefront of enhancing the security of our platform. Your primary responsibility will be to design, develop, and implement security solutions that seamlessly integrate into our developers' workflows. This role is crucial in ensuring that security is not an afterthought but a foundational aspect of our software development lifecycle. You will collaborate closely with engineering teams to establish secure architectures and drive the adoption of security best practices across the organization.

Key facts

What you'll do

• Embed security measures into CI/CD pipelines to promote secure-by-default engineering practices across the organization.
• Create and implement security controls, libraries, and guardrails directly within the codebase to enhance overall application security.
• Develop and scale automated security tools across CI/CD processes, including Static Application Security Testing (SAST), dependency scanning, secrets detection, and fuzz testing.
• Design and refine mechanisms for detecting and preventing abuse, data exfiltration, and risks associated with supply chain vulnerabilities.
• Automate workflows for vulnerability triage, prioritization, and remediation to ensure efficient handling of security issues at scale.
• Collaborate with developers to integrate security into their workflows and internal platforms, aiming to reduce friction and enhance security adoption.
• Design and implement security controls for agentic and AI-assisted workflows, establishing guardrails to mitigate risks such as prompt injection and misuse of privileges.
• Participate in system design and architecture reviews, contributing to threat modeling for new products and features to ensure security is prioritized from the outset.

Requirements

• A minimum of 6 years of experience in software engineering, application security, or security engineering is essential.
• Proficiency in at least one programming language, such as Python, Go, C#, JavaScript, Rust, or C++.
• Experience in building and scaling security automation within CI/CD pipelines, including tools for SAST, Software Composition Analysis (SCA), and secrets detection.
• A solid grasp of application security fundamentals, including knowledge of the OWASP Top 10, authentication models, and common vulnerabilities and their mitigations.
• Familiarity with cloud environments and modern architectural practices, including microservices and APIs.
• Working knowledge of Linux and Windows systems, networking principles, and system-level security practices.
• Demonstrated experience in designing and implementing secure, scalable systems, including APIs and distributed architectures.
• Ability to translate complex security risks into practical, scalable engineering solutions.
• A bachelor's degree in a relevant field or equivalent practical experience is required.

Nice to have

• Experience in developing security platforms, tools, or frameworks tailored for developers.
• Knowledge of cryptographic principles, Public Key Infrastructure (PKI), TLS, and secure implementation practices.
• Familiarity with container security and orchestration tools like Kubernetes.
• Experience in building internal security platforms or developer tooling to enhance security practices.
• Background in supply chain security, including Software Bill of Materials (SBOMs), signing, provenance, and ensuring build integrity.

Skills & tools

• Proficient in security automation tools and practices within CI/CD environments.
• Strong coding skills in multiple programming languages.
• Familiar with security frameworks and standards relevant to application security.
• Knowledgeable about cloud security best practices and modern software architectures.

Practical notes

For candidates based at our headquarters in San Mateo, CA, the starting base salary for this position ranges from $269,170 to $326,060 USD annually. The actual salary may vary based on factors such as professional experience, training, and market demand. This salary range is subject to change and may be updated in the future. All full-time employees are eligible for equity compensation and benefits as outlined on our careers page.

Roblox is committed to providing equal employment opportunities to all employees and applicants, prohibiting discrimination and harassment based on various characteristics. We also offer reasonable accommodations during the recruiting process for candidates with qualifying disabilities or religious beliefs.

Please note that for U.S.-based roles, the company may not be able to employ candidates who require specific U.S. work authorization related to certain visa categories or support future H-1B sponsorship at this time.