Principal Security Engineer, Enterprise Security

Every day, tens of millions of people come to Roblox to explore, create, play, learn, and connect with friends in 3D immersive digital experiences– all created by our global community of developers and creators. At Roblox, we’re building the tools and platform that empower our community to bring any experience that they can imagine to life. Our vision is to reimagine the way people come together, from anywhere in the world, and on any device. We’re on a mission to connect a billion people with optimism and civility, and looking for amazing talent to help us get there. A career at Roblox means you’ll be working to shape the future of human interaction, solving unique technical challenges at scale, and helping to create safer, more civil shared experiences for everyone. As a Principal Security Engineer on the Enterprise Security team, you will set and execute Roblox's Enterprise Security strategy across corporate infrastructure. You will design, deploy, and govern security solutions, and use low-code and no-code automation to scale them. You will define how Roblox secures AI agents and agentic workflows. You will partner with InfoSec, Corporate Engineering, Trust & Safety, and business teams to deliver secure-by-design outcomes without slowing the business. You will: Lead enterprise security strategy: Own the roadmap across Endpoint Security, SaaS Security, Supply Chain Security, and Identity & Access Management, and set architectural direction for the team. Lead AI and agentic security: Define governance, threat models, and guardrails for AI agents, MCP servers, and AI tooling. This covers agent identity, scoped and short-lived access, delegated access, tool permissioning, and auditability. Evaluate and implement vendor solutions: Run build vs. buy decisions, assess commercial platforms against enterprise requirements and compliance standards, and extend them through configuration and integrations. Automate with low-code and no-code: Design and operate orchestration workflows that enforce policy, collect metrics, and remediate risk at scale, writing scripts only where needed. Drive secure-by-design adoption: Partner with IT, Corporate Engineering, DevOps, and business stakeholders to embed security controls into enterprise systems, workflows, and AI adoption. Raise the bar: Mentor senior engineers, lead threat modeling and security reviews, and influence cross-functional plans. You have: 10+ years of relevant security experience, with a track record of leading cross-functional initiatives. Hands-on experience securing AI and agentic systems, such as agent identity and authorization, MCP and tool access controls, prompt injection and data exfiltration risks, and AI governance frameworks. Working knowledge of IAM concepts: SSO, MFA and passkeys, OAuth 2.0, SAML, SCIM, privileged access, and machine identity. Experience designing or operating workflows on low-code and no-code orchestration platforms. Deep knowledge of endpoint, SaaS, and supply chain security controls and risk management. Strong understanding of zero trust architecture, threat modeling, and frameworks such as SOC 2 and ISO 27001. Ability to read and write scripts for automation (Python or similar) is a plus, not a requirement. Expertise in Google Workspace, Okta, and OSQuery is a plus. You are: Strategic: You define clear requirements, weigh build vs. buy, and balance security rigor with business pragmatism. Collaborative: You influence across teams and deliver security outcomes without slowing partners down. Comfortable with ambiguity: You make sound decisions with incomplete information, especially in fast-moving areas like agentic AI. A technical leader: You mentor others and raise the bar for design, review, and judgment. For roles that are based at our headquarters in San Mateo, CA: The starting base pay for this position is as shown below. The actual base pay is dependent upon a variety of job