Principal Security Engineer (Enterprise Security)
Posted Updated
Description
- As a Principal Security Engineer on the Enterprise Security team, you will set and execute Roblox’s Enterprise Security strategy across corporate infrastructure
- You will design, deploy, and govern security solutions, and use low-code and no-code automation to scale them. You will define how Roblox secures AI agents and agentic workflows
- You will partner with InfoSec, Corporate Engineering, Trust & Safety, and business teams to deliver secure-by-design outcomes without slowing the business
- Lead enterprise security strategy: Own the roadmap across Endpoint Security, SaaS Security, Supply Chain Security, and Identity & Access Management, and set architectural direction for the team
- Lead AI and agentic security: Define governance, threat models, and guardrails for AI agents, MCP servers, and AI tooling. This covers agent identity, scoped and short-lived access, delegated access, tool permissioning, and auditability
- Evaluate and implement vendor solutions: Run build vs. buy decisions, assess commercial platforms against enterprise requirements and compliance standards, and extend them through configuration and integrations
- Automate with low-code and no-code: Design and operate orchestration workflows that enforce policy, collect metrics, and remediate risk at scale, writing scripts only where needed
- Drive secure-by-design adoption: Partner with IT, Corporate Engineering, DevOps, and business stakeholders to embed security controls into enterprise systems, workflows, and AI adoption
- Raise the bar: Mentor senior engineers, lead threat modeling and security reviews, and influence cross-functional plans
- Working knowledge of IAM concepts: SSO, MFA and passkeys, OAuth 2.0, SAML, SCIM, privileged access, and machine identity
- Strong understanding of zero trust architecture, threat modeling, and frameworks such as SOC 2 and ISO 27001
- Ability to read and write scripts for automation (Python or similar) is a plus, not a requirement
- 10+ years of relevant security experience, with a track record of leading cross-functional initiatives
- Hands-on experience securing AI and agentic systems, such as agent identity and authorization, MCP and tool access controls, prompt injection and data exfiltration risks, and AI governance frameworks
- A technical leader: You mentor others and raise the bar for design, review, and judgment
- Experience designing or operating workflows on low-code and no-code orchestration platforms
- Expertise in Google Workspace, Okta, and OSQuery is a plus
- Deep knowledge of endpoint, SaaS, and supply chain security controls and risk management
- Strategic: You define clear requirements, weigh build vs. buy, and balance security rigor with business pragmatism
- Collaborative: You influence across teams and deliver security outcomes without slowing partners down
- Comfortable with ambiguity: You make sound decisions with incomplete information, especially in fast-moving areas like agentic AI