Senior Offensive Security Engineer
About the role
The Senior Offensive Security Engineer within the Detection and Response team (DART) at Roblox engages in offensive security assessments to strengthen the defense capabilities of the company. They work closely with the larger InfoSec team, detection engineers, and external engineering partners to identify security weaknesses, validate detection mechanisms, and provide actionable recommendations to enhance the security posture.
Responsibilities
- Conduct full-stack security assessments across the entire technology stack, including web applications, APIs, cloud infrastructure, and backend systems.
- Collaborate with detection engineers through purple team exercises, attack simulations, and threat emulation to validate and improve detection coverage.
- Create and maintain security testing tools, BAS frameworks, and automation scripts that enable repeatable testing and quantifiable security improvements.
- Design and implement frameworks to measure security control effectiveness, detection coverage, and improvement over time through consistent testing methodologies.
- Stay current with the latest attack techniques, tools, and methodologies while contributing to both offensive and defensive security improvements.
- Broadly collaborate across security teams and foster a culture of continuous security improvement.
Requirements
- 4+ years of relevant professional experience in offensive security, with demonstrated experience in purple team exercises, breach attack simulation, and detection engineering collaboration.
- Proficiency in Python or Go for building security tooling and automation, including experience with SOAR platforms and configuration management.
- Deep understanding of OWASP Top 10 vulnerabilities; common attack techniques; exploit development; post-exploitation methodologies; security assessment frameworks (MITRE ATT&CK, PTES); BAS methodologies; and modern detection stack components (EDR, SIEM, XDR).
- Knowledge of security concepts including reverse engineering, cloud security (AWS/Azure/GCP), container security, CI/CD pipeline security, API security, and security metrics development.
- Certifications such as OSCP, OSCE, GXPN, or equivalent practical experience.
- Strong analytical and problem-solving abilities; excellent technical writing for detailed reports; ability to clearly communicate complex technical concepts; self-motivated with a passion for offensive security and detection engineering.
Qualifications
- Experience with offensive security tools and techniques.
- Understanding of cloud computing services (AWS, Azure, GCP).
- Experience with containerization technologies (Docker, Kubernetes).
- Knowledge of CI/CD pipelines and security practices.
- Experience with API security and security metrics development.
Skills
- Python or Go programming.
- Experience with SOAR platforms.
- Knowledge of security assessment frameworks (MITRE ATT&CK, PTES).
- Experience with EDR, SIEM, and XDR components.
- Reverse engineering skills.
- Cloud security expertise (AWS, Azure, GCP).
- Container security knowledge.
- CI/CD pipeline security understanding.
- API security expertise.
- Security metrics development skills.
Benefits
Roblox offers competitive compensation packages, including a range of annual salaries from $196,750 to $243,290 USD, depending on various job-related factors. Full-time employees are also eligible for equity compensation and benefits as described on this page.
Pay
The starting base pay for this position is as shown below. The actual base pay is dependent upon a variety of job-related factors such as professional background, training, work experience, location, business needs, and market demand. Therefore, in some circumstances, the actual salary could fall outside of this expected range.
Annual Salary Range: $196,750—$243,290 USD
Schedule
Roles that are based at our headquarters in San Mateo, CA are onsite Tuesday, Wednesday, and Thursday, with optional presence on Monday and Friday (unless otherwise noted).