Senior Offensive Security Engineer

Job Summary

A career at Roblox means you’ll be working to shape the future of human interaction, solving unique technical challenges at scale, and helping to create safer, more civil shared experiences for everyone.

About the Role

As an Offensive Security Engineer within the Detection and Response team (DART), you'll engage in the offensive security assessments that strengthen our defense capabilities. Working closely with the larger InfoSec team, detection engineers, and external engineering partners, you'll identify security weaknesses, validate detection mechanisms, and provide actionable recommendations to enhance our security posture.

Responsibilities

• Conducting full-stack security assessments across our entire technology stack, including web applications, APIs, cloud infrastructure, and backend systems.
• Collaborating with detection engineers through purple team exercises, attack simulations, and threat emulation to validate and improve detection coverage.
• Creating and maintaining security testing tools, BAS frameworks, and automation scripts that enable repeatable testing and quantifiable security improvements.
• Designing and implementing frameworks to measure security control effectiveness, detection coverage, and improvement over time through consistent testing methodologies.
• Staying current with latest attack techniques, tools, and methodologies while contributing to both offensive and defensive security improvements.
• Broadly collaborating across security teams and fostering a culture of continuous security improvement.

Requirements

• 4+ years of relevant professional experience in offensive security, with demonstrated experience in purple team exercises, breach attack simulation, and detection engineering collaboration.
• Development experience: proficiency in Python or Go for building security tooling and automation, including experience with SOAR platforms and configuration management.
• Security assessment expertise: performing full-stack security assessments of web applications, APIs, cloud infrastructure, and backend systems.
• Platform expertise: implementing and managing breach attack simulation platforms while working with detection engineering teams to validate and improve detection coverage.
• Deep understanding: of OWASP Top 10 vulnerabilities; common attack techniques; exploit development; post-exploitation methodologies; security assessment frameworks (MITRE ATT&CK, PTES); BAS methodologies; and modern detection stack components (EDR, SIEM, XDR).
• Knowledge: of security concepts including reverse engineering, cloud security (AWS/Azure/GCP), container security, CI/CD pipeline security, API security, and security metrics development.
• Certifications: such as OSCP, OSCE, GXPN, or equivalent practical experience.
• Organizational skills: strong analytical and problem-solving abilities; excellent technical writing for detailed reports; ability to clearly communicate complex technical concepts; self-motivated with a passion for offensive security and detection engineering.

Qualifications

• Strong analytical and problem-solving abilities.
• Excellent technical writing for detailed reports.
• Ability to clearly communicate complex technical concepts.
• Self-motivated with a passion for offensive security and detection engineering.

Skills

• Proficiency in Python or Go for building security tooling and automation.
• Experience with SOAR platforms and configuration management.
• Performing full-stack security assessments of web applications, APIs, cloud infrastructure, and backend systems.
• Implementing and managing breach attack simulation platforms.
• Developing custom tools and frameworks for security testing and automation.
• Designing and implementing security metrics and frameworks.
• Staying current with latest attack techniques, tools, and methodologies.
• Contributing to both offensive and defensive security improvements.

Benefits

Roblox provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Roblox also provides reasonable accommodations to candidates with qualifying disabilities or religious beliefs during the recruiting process.

Pay

The starting base pay for this position is as shown below. The actual base pay is dependent upon a variety of job-related factors such as professional background, training, work experience, location, business needs and market demand. Therefore, in some circumstances, the actual salary could fall outside of this expected range. This pay range is subject to change and may be modified in the future. All full-time employees are also eligible for equity compensation and for benefits as described on this page.

Schedule

Roblox provides flexible scheduling options for its employees, including the option to work remotely or in-office on a schedule that works best for them.