Senior Offensive Security Engineer, Roblox
$196.8-243.3k
+ Equity
More information about location
Office located in San Mateo, CA
Online gaming & entertainment platform
Be an early applicant
Online gaming & entertainment platform
1001+ employees
Be an early applicant
$196.8-243.3k
+ Equity
More information about location
Office located in San Mateo, CA
1001+ employees
Company mission
To connect a billion people with optimism and civility.
Role
Who you are
- 4+ years: of relevant professional experience in offensive security, with demonstrated experience in purple team exercises, breach attack simulation, and detection engineering collaboration
- Development experience: proficiency in Python or Go for building security tooling and automation, including experience with SOAR platforms and configuration management
- Security assessment expertise: performing full-stack security assessments of web applications, APIs, cloud infrastructure, and backend systems
- Platform expertise: implementing and managing breach attack simulation platforms while working with detection engineering teams to validate and improve detection coverage
- Deep understanding: of OWASP Top 10 vulnerabilities; common attack techniques; exploit development; post-exploitation methodologies; security assessment frameworks (MITRE ATT&CK, PTES); BAS methodologies; and modern detection stack components (EDR, SIEM, XDR)
- Knowledge: of security concepts including reverse engineering, cloud security (AWS/Azure/GCP), container security, CI/CD pipeline security, API security, and security metrics development
- Certifications: such as OSCP, OSCE, GXPN, or equivalent practical experience
- Organizational skills: strong analytical and problem-solving abilities; excellent technical writing for detailed reports; ability to clearly communicate complex technical concepts; self-motivated with a passion for offensive security and detection engineering
- Collaborative: You thrive working with your direct team and cross-functional partners, especially in bridging the gap between offensive operations and detection engineering
- Thoughtful of build vs. buy decisions: Comfortable with deploying and configuring Open Source software, but you also review what tools are available in the market to make informed decisions about tool selection and development
- Comfortable with ambiguity: You can gather data and make informed decisions when there is no clear answer, especially when dealing with novel attack scenarios or detection challenges
- Security-minded educator: You excel at translating complex technical findings into actionable insights for various stakeholders across the organization
- Metrics-driven: You understand the importance of measuring security improvements and can develop frameworks to quantify the effectiveness of security controls and detection capabilities
- Improvement-oriented: You actively seek opportunities to enhance both offensive capabilities and detection coverage, always thinking about the bigger security picture
- Adaptable: You stay current with evolving threats and defense mechanisms, adjusting your approach as the security landscape changes
What the job involves
- As an Offensive Security Engineer within the Detection and Response team (DART), you'll engage in the offensive security assessments that strengthen our defense capabilities
- Working closely with the larger InfoSec team, detection engineers, and external engineering partners, you'll identify security weaknesses, validate detection mechanisms, and provide actionable recommendations to enhance our security posture
- You'll collaborate with various architecture and engineering teams to continuously validate and improve our security controls and detection capabilities, with a strong focus on developing repeatable testing frameworks and metrics-driven security improvements
- Perform offensive security assessments: conducting full-stack security assessments across our entire technology stack, including web applications, APIs, cloud infrastructure, and backend systems
- Drive detection engineering partnerships: collaborating with detection engineers through purple team exercises, attack simulations, and threat emulation to validate and improve detection coverage
- Develop custom tools and frameworks: creating and maintaining security testing tools, BAS frameworks, and automation scripts that enable repeatable testing and quantifiable security improvements
- Build security metrics: designing and implementing frameworks to measure security control effectiveness, detection coverage, and improvement over time through consistent testing methodologies
- Research and innovate: staying current with latest attack techniques, tools, and methodologies while contributing to both offensive and defensive security improvements
- Broadly collaborate: sharing knowledge across security teams and fostering a culture of continuous security improvement
Our take
Online gaming may be a well-established space, but Roblox has distinguished itself as a leader by empowering its community to build, share, and profit from their own creations - turning game development into an accessible, rewarding ecosystem for millions of users.
In addition to standard games, the platform offers virtual worlds and other experiences to explore and interact with. Its platform provides an online ecosystem for millions to create, socialize, chat, and explore immersive experiences with friends. In fact, in the US its used by two-thirds of children aged 9 to 12.
The platform has faced scrutiny over user safety, but responded by strengthen parental controls and launching initiatives like its "Parents Council". This move to address these issues, atop its strong financial performance and record payouts to developers, showcase Roblox's trajectory as one of innovation and impressive growth.
Freddie
Company Specialist at Welcome to the Jungle
Insights
25% employee growth in 12 months
Company
Funding (last 2 of 9 rounds)
Jan 2021
$520m
SERIES H
Feb 2020
$150m
SERIES G
Total funding: $922.8m
Company HQ
South San Mateo, San Mateo, CA
Leadership
David Baszucki
(Founder & CEO)Studied Electrical Engineering at Stanford before founding Knowledge Revolution in 1990, where they spent 9 years as CEO. They worked as VP of MSC.Software for 2 years, and started Roblox in 2005.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 147 more jobs at Roblox