Senior Offensive Security Engineer

Overview

Offensive Security Engineer within the Detection and Response team (DART), conducting offensive security assessments that strengthen Roblox's defense capabilities and working closely with InfoSec, detection engineers, and external engineering partners.

What you'll do

• Perform full-stack security assessments across web applications, APIs, cloud infrastructure, and backend systems.
• Identify security weaknesses, validate detection mechanisms, and provide actionable recommendations to enhance the security posture.
• Drive detection engineering partnerships through purple team exercises, attack simulations, and threat emulation to validate and improve detection coverage.
• Develop custom security testing tools, BAS frameworks, and automation scripts that enable repeatable testing and quantifiable security improvements.
• Build security metrics frameworks to measure security control effectiveness, detection coverage, and improvement over time.
• Research the latest attack techniques, tools, and methodologies, contributing to both offensive and defensive security improvements.
• Share knowledge across security teams and foster a culture of continuous security improvement.

What you'll need

• 4+ years of relevant professional experience in offensive security, with demonstrated experience in purple team exercises, breach attack simulation, and detection engineering collaboration.
• Proficiency in Python or Go for building security tooling and automation, including experience with SOAR platforms and configuration management.
• Security assessment expertise in performing full-stack security assessments of web applications, APIs, cloud infrastructure, and backend systems.
• Experience implementing and managing breach attack simulation platforms while working with detection engineering teams to validate and improve detection coverage.
• Deep understanding of OWASP Top 10 vulnerabilities, common attack techniques, exploit development, post-exploitation methodologies, security assessment frameworks (MITRE ATT&CK, PTES), BAS methodologies, and modern detection stack components (EDR, SIEM, XDR).
• Knowledge of reverse engineering, cloud security (AWS/Azure/GCP), container security, CI/CD pipeline security, API security, and security metrics development.
• Certifications such as OSCP, OSCE, GXPN, or equivalent practical experience.
• Strong analytical and problem-solving abilities, excellent technical writing for detailed reports, and ability to clearly communicate complex technical concepts.
• Self-motivated with a passion for offensive security and detection engineering.

Details

• Location: San Mateo, CA, United States (headquarters).
• Onsite Tuesday, Wednesday, and Thursday, with optional presence on Monday and Friday.
• Annual base salary range: $196,750 to $243,290 USD.
• Full-time employees are eligible for equity compensation and benefits.
• For US based roles only: the Company may not be able to employ candidates who have United States work authorization related to certain U.S. visa categories, or support future H-1B sponsorship at this time.