Senior AppSec Engineer - DevSecOps & AI Guardrails NEW

The Briefed; San Mateo (CA); On-site; USD 269,000 - 326,000; Full time

Benefits offered by this job

Equity package

Healthcare coverage

401(k) plan

Campus perks

Job summary

Roblox is seeking a Senior Security Software Engineer on Application Security to hands-on design, ship, and scale security controls integrated into developer workflows and CI/CD pipelines.

You will bridge threat modeling, code reviews, penetration testing, and vulnerability triage with automated tooling (SAST, SCA, secrets detection, fuzzing) and pioneer guardrails for AI-assisted developer workflows to mitigate prompt injections and data exfiltration.

Qualifications

• 6+ years of professional experience in software engineering, application security, or security engineering.
• Proficient in at least one core programming language (Python, Go, C#, JavaScript, Rust, or C++).
• Proven experience integrating and scaling security tools (SAST, SCA, secrets detection, dynamic fuzzing) within automated deployment pipelines.
• Solid mastery of OWASP Top 10 vulnerabilities, authentication/authorization models, microservice architectures, and secure coding practices.
• Background operating in public cloud environments (AWS/GCP), containerized microservices, APIs, Linux/Windows systems, and networking security basics.
• Demonstrated ability to translate abstract security risks into practical, maintainable software controls.
• Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, or equivalent practical experience.

Responsibilities

• DevSecOps Pipeline Security: Build and integrate automated security tooling into CI/CD pipelines to enforce secure-by-default engineering practices.
• Secure Libraries & Guardrails: Design production-grade security controls and cryptographic primitives in code.
• AI & Agentic Workflow Protection: Implement guardrails for AI-assisted developer tools and mitigate prompt injection risks.
• Threat Modeling & Architecture Reviews: Partner with engineering teams to conduct threat modeling and secure reviews for features and microservices.
• Automated Remediation Workflows: Automate vulnerability triage, prioritization, and fix-tracking at scale.
• Supply Chain & Abuse Defense: Develop detection and prevention mechanisms against software supply chain risks.
• On-Call Operations: Participate in on-call rotation and contribute to security platform evolution.

Skills

6+ years

Python

Go

C#

JavaScript

Rust

C++

CI/CD security automation

OWASP Top 10

Cloud and container security

Linux/Windows systems

Threat modeling

Education

Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, or equivalent practical experience

Tools

SAST tooling

SCA tooling

Fuzzing tools

Vulnerability triage tooling

Job description

Every day, tens of millions of people come to Roblox to explore, create, play, learn, and connect across 3D immersive digital experiences. The Security Organization at Roblox designs and engineers secure systems from inception through production, enabling product and infrastructure teams to operate securely by default.

As a Senior Security Software Engineer on Application Security, you will be a hands-on builder who designs, ships, and scales security controls directly integrated into developer workflows and CI/CD pipelines. You will bridge deep technical security work—threat modeling, code reviews, penetration testing, and vulnerability triage—with systemic automation solutions (SAST, SCA, secrets detection, fuzzing, and secure-by-default libraries). Additionally, you will pioneer security controls and guardrails for agentic and AI-assisted developer workflows to mitigate risks like prompt injection, data exfiltration, and privilege escalation.

Key Responsibilities

• DevSecOps Pipeline Security: Build, scale, and integrate automated security tooling (SAST, SCA, secrets detection, fuzzing) into CI/CD pipelines to enforce secure-by-default engineering practices.
• Secure Libraries & Guardrails: Design and write production-grade security controls, cryptographic primitives, authentication/authorization libraries, and reusable patterns directly in code.
• AI & Agentic Workflow Protection: Implement security guardrails for AI-assisted developer tools and agentic workflows, mitigating risks like prompt injection, data exfiltration, and privilege abuse.
• Threat Modeling & Architecture Reviews: Partner with engineering teams early in the software development lifecycle to conduct threat modeling and secure architecture reviews for new features and microservices.
• Automated Remediation Workflows: Automate vulnerability triage, prioritization, and fix-tracking workflows at scale to minimize developer friction and improve time-to-remediation.
• Supply Chain & Abuse Defense: Develop detection and prevention mechanisms against software supply chain risks, data exfiltration vectors, and bad-actor abuse on the platform.
• On-Call Operations: Participate in the Application Security team on-call rotation and contribute to continuous security platform evolution.

Requirements

Application Security & Software Engineering Depth

• 6+ years of professional experience in software engineering, application security, or security engineering.
• Strong Coding Ability: Proficient in at least one core programming language (Python, Go, C#, JavaScript, Rust, or C++).
• CI/CD Security Automation: Proven experience integrating and scaling security tools (SAST, SCA, secrets detection, dynamic fuzzing) within automated deployment pipelines.
• AppSec Fundamentals: Solid mastery of OWASP Top 10 vulnerabilities, authentication/authorization models, microservice architectures, and secure coding practices.
• Cloud & Systems Fundamentals: Background operating in public cloud environments (AWS/GCP), containerized microservices, APIs, Linux/Windows systems, and networking security basics.
• Risk-to-Code Translation: Demonstrated ability to translate abstract security risks into practical, maintainable, and developer-friendly software controls.
• Education: Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, or equivalent practical experience.

Preferred Qualifications

• Experience building in-house security platforms, developer frameworks, or internal security tools.
• Deep knowledge of modern cryptography, Public Key Infrastructure (PKI), TLS, and secure implementations.
• Experience with container security, Kubernetes RBAC, and cloud-native security postures.
• Background in software supply chain security (SBOMs, binary signing, build provenance, SLSA frameworks).

Total Rewards & Benefits

• Compensation & Equity: Annual base salary range of $269,170 – $326,060 USD + comprehensive equity compensation package.
• Healthcare & Wellness: Comprehensive medical, dental, and vision insurance coverage options for employees and eligible dependents.
• Retirement & Financial: 401(k) retirement savings plan with employer match, life insurance, and flexible spending accounts.
• HQ Campus Perks: On-site catered meals, modern collaborative workspaces, learning and development stipends, and team events.