Principal Security Software Engineer (Application Security)
Posted Updated
Description
- As a Principal Security Software Engineer, you will be reporting to the Manager of Application Security leading the Security Design and Review pod
- You will play a pivotal role in shaping the growth of Information Security’s (InfoSec) Application Security team, collaborating with engineering teams early in their processes to provide secure design solutions and establish security standards
- Your responsibilities will include threat modeling, secure system design, automation, and penetration testing
- As a key member of the team, you will drive company-wide projects across diverse tech stacks, working with engineering leaders to remediate security challenges
- You will define and evolve the technical vision for scaling application security practices across the organization
- Lead company-wide security initiatives to address critical security challenges
- Build and nurture cross-company relationships to achieve security objectives
- Provide guidance on product security processes and standards
- Define and expand partnerships with key engineering teams across Roblox
- Apply critical thinking and analytical skills to develop security protocols and communicate effectively with stakeholders
- Research and evaluate new technologies to enhance the company’s security posture
- Identify potential threats and vulnerabilities in our systems and data, as well as help develop and implement solutions to safeguard them
- Enable cross-functional teams to implement security solutions aligned with Trust-by-Design principles
- Contribute to security education and awareness programs by partnering across teams to collaboratively build and promote shared understanding of security practices throughout the company
- Shape strategies to automate and scale application and product security efforts
- Design and secure autonomous agentic workflows
- Test application code following the OWASP Testing Methodology
- Mentor and guide other security engineers!
- Proven ability to build strong relationships and influence principal engineers across teams
- Expertise in explaining complex security challenges and solutions to both technical and non-technical leadership
- Experience operationalizing security best practices in large-scale internet environments
- Background in writing code in at least one programming language, such as Python, Golang, or C#, and a scripting language like Bash or Python
- Experience with threat modeling and Secure Software Development Life Cycles
- Familiarity with enabling safe AI adoption at scale, balancing security, developer productivity, and organizational risk
- Applied knowledge of cryptography, PKI, TLS, and practical implementations
- Familiarity with secure deployment patterns for AI agents, including isolation strategies (sandboxing, microVMs), secrets protection, and audit/logging for agent capabilities
- Familiarity with network and server hardware, as well as Linux and Windows security
- Experience in software and infrastructure architecture with a focus on security
- 8+ years of professional experience in cybersecurity, with a deep background in application security, data encryption, and compliance with security standards, as well as knowledge of network and cloud security
- Extensive experience with common code and network vulnerabilities, their impacts, and remediation strategies
- Passionate about security and knowledgeable about security principles, understanding their value to an organization
- Passionate about long-term solutions that drive lasting security improvements, prioritizing sustainable change over quick fixes
- A team-oriented, collaborative professional who enjoys working with others