Drimva

Roblox

Senior Security Software Engineer, Application Security

$269K–$326K

San Mateo, CA, United States · Senior · Full-time · Posted May 6, 2026

Experience
6+ years in software engineering, application security, or security engineering.
Education
Bachelor’s degree in a relevant field or equivalent practical experience.
Visa sponsorship
For US-based roles, the company may be unable to employ candidates with work authorization related to certain U.S. visa categories or support future H-1B sponsorship at this time.

About the job

Builds and scales application security solutions embedded in Roblox’s developer workflows, CI/CD pipelines, and platforms.

What you'll do

  • Integrate security controls, automation, and guardrails into CI/CD pipelines and developer workflows.
  • Build and improve tooling and mechanisms for vulnerability management, abuse prevention, data-exfiltration prevention, and supply-chain security.
  • Conduct architecture reviews and threat modeling, including for agentic and AI-assisted workflows; participate in AppSec on-call rotations.

What they ask for

  • Strong coding skills in at least one language, such as Python, Go, C#, JavaScript, Rust, or C++.
  • Experience building and scaling CI/CD security automation, including SAST, SCA, secrets detection, and fuzzing.
  • Knowledge of application security fundamentals, cloud environments, modern architectures, and system security.
  • Bachelor’s degree in a relevant field or equivalent practical experience.

Nice to have

  • Experience building security platforms, tools, or developer frameworks.
  • Knowledge of cryptography, PKI, TLS, container security, Kubernetes, or supply-chain security.

Pay

$269,170 — $326,060 USD (base salary)

Tools

Python, Go, C#, JavaScript, Rust, C++, Kubernetes, Linux/Windows

AI focus

Design and implement security controls for agentic and AI-assisted workflows, including guardrails against prompt injection, data exfiltration, and misuse of developer and system privileges.

Model-written summary · the original posting is authoritative

First seen Oct 10, 2026 · Last verified Nov 4, 2026 (UTC)