Principal Security Software Engineer, IAM

Overview

Principal Security Software Engineer on the Production IAM team, setting technical direction for identity and access across Roblox's production infrastructure, from service-to-service mTLS identity to privileged access for engineers, and helping pioneer identity and access for AI agents.

What you'll do

• Lead the architecture for production identity and access across machine, workload, human, and AI-agent identity on the hybrid on-prem and cloud fleet.
• Drive mTLS and workload identity to full production enforcement.
• Lead the technical strategy for the SPIFFE/SPIRE-based identity platform, service-mesh integration, managed service accounts, and certificate issuance, storage, and rotation.
• Architect just-in-time, least-privilege, and break-glass access to production, replacing static, long-lived credentials with short-lived, auditable access that stays reliable during dependency or identity-provider outages.
• Evolve the centralized authorization engine and the access-control models behind it (RBAC/ABAC and risk-based access).
• Define how AI agents obtain credentials, receive scoped permissions, and have their sessions managed across their lifecycle.
• Author RFCs and multi-year roadmaps, align stakeholders across Roblox Platform, mentor senior and staff engineers, and raise the technical bar through design review, on-call ownership, and hiring.

What you'll need

• 8+ years of relevant professional experience building scalable, distributed backend systems, with a track record of driving architecture end to end.
• Deep expertise in identity and access management, including authentication, authorization, and access-control models such as RBAC, ABAC, or risk-based access control.
• Hands-on experience with several of: PKI and certificate/key lifecycle management, mTLS, SPIFFE/SPIRE or comparable workload-identity systems, service mesh, secret management (e.g., Vault), and privileged access management (PAM).
• Proficiency in at least one systems language such as Go, Rust, Java, C++, Python, or C# .NET, and a habit of building systems rather than only configuring vendor tools.
• Experience leading the technical work of other engineers, setting direction across teams, writing influential design docs, and mentoring senior talent.
• AI fluency: uses AI tools in daily workflow, understands LLM capabilities and limitations, and can reason about giving an AI agent an identity and permissions.
• A Bachelor's degree or equivalent experience in Computer Science, Computer Engineering, or a similar technical field.

Details

• Location: San Mateo, CA, United States (headquarters).
• Roles based in the office are onsite Tuesday, Wednesday, and Thursday, with optional presence on Monday and Friday (unless otherwise noted).
• Annual base salary range: $326,060 to $385,050 USD, plus equity compensation and benefits for full-time employees.
• For US-based roles only, the Company may not be able to employ candidates who have United States work authorization related to certain U.S. visa categories, or support future H-1B sponsorship at this time.