Principal Security Engineer - Security Design & AI

Every day, tens of millions of people come to Roblox to explore, create, play, learn, and connect in 3D immersive digital experiences. Protecting this global ecosystem requires embedding security into software architecture from day zero.

As a Principal Security Software Engineer, reporting to the Manager of Application Security, you will lead the Security Design and Review pod within InfoSec. In this high-impact technical leadership role, you will define and scale application security practices company-wide. You will collaborate directly with principal engineering leads early in the SDLC to architect secure systems, establish security standards, conduct threat modeling, perform penetration testing following OWASP methodologies, and build automation. Crucially, you will lead the strategic efforts to secure autonomous agentic workflows and AI deployments—implementing isolation patterns (sandboxing, microVMs), secrets protection, and AI capability audit logging.

Key Responsibilities

• Security Design & Architecture Leadership: Lead company-wide AppSec initiatives, partnering with principal engineers during early design phases to enforce Trust-by-Design principles and secure architecture patterns.
• Threat Modeling & Assessment: Perform threat modeling, vulnerability assessments, and code penetration testing using OWASP Testing Methodologies across diverse tech stacks.
• Autonomous AI & Agent Security: Architect secure deployment patterns for AI agents and autonomous workflows, implementing isolation strategies (microVMs, sandboxing), secrets protection, and audit logging.
• Automation & Scalability: Shape strategies to automate application security checks, static/dynamic code analysis, and developer-facing security guardrails at scale.
• Cryptography & Infrastructure Security: Advise engineering teams on practical implementations of cryptography, PKI, TLS, key management, and identity controls.
• Technical Mentorship & Enablement: Mentor security engineers, drive security education programs, and influence engineering leaders to adopt long-term, sustainable security improvements.

Requirements

Application Security & Technical Depth

• 8+ years of professional cybersecurity experience, with deep expertise in application security, threat modeling, data encryption, PKI, TLS, and compliance.
• Software Development Fluency: Hands-on experience writing production or security automation code in languages such as Python, Golang, or C#, alongside scripting languages (Bash, Python).
• AI & Agent Security Foundations: Familiarity with secure deployment patterns for AI agents, including execution isolation (sandboxing, microVMs), secrets management, and agent capability auditing.
• OWASP & Penetration Testing: Deep experience testing application code and microservices following OWASP testing frameworks and remediating software/network vulnerabilities.
• Executive Communication & Influence: Proven ability to explain complex technical security risks and trade-offs clearly to both engineering leadership and non-technical executives.
• Architecture & System Security: Strong foundation in cloud infrastructure security, network hardware, Linux/Windows OS security, and operationalizing security in high-throughput internet environments.

Education & Work Logistics

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent practical industry experience.
• Ability to work onsite at least 3 days per week (Tuesday, Wednesday, Thursday) at Roblox headquarters in San Mateo, CA.

Preferred Qualifications

• Demonstrated success driving security culture and architecture across large-scale consumer internet platforms or multi-tenant SaaS environments.
• Active contributions to security research, open-source AppSec tools, or threat modeling frameworks.
• Deep experience balancing developer productivity with risk mitigation in AI-native engineering environments.

Total Rewards & Benefits

• Compensation & Equity: Base salary of $326,060 – $385,050 USD + competitive equity grants.
• Comprehensive Healthcare: Premium medical, dental, and vision insurance options for employees and eligible dependents.
• Workplace Perks: Onsite collaboration at San Mateo HQ with flexible hybrid arrangements on Mondays and Fridays, plus dedicated learning and development budgets.