Senior Security Software Engineer, Sandbox Platforms

Roblox
San Mateo
Workplace: OnsiteFull timeUSD 269,170 - 326,060 annuallyFunction: Software EngineeringSkills: ["Threat modeling","Attack surface analysis","Systems thinking","Documentation","Least privilege mindset","Security mindset"]

Design and harden process sandboxes that isolate untrusted and semi-trusted code across Linux, macOS, and Windows. Build communication boundaries using platform primitives (e.g., nsjail/seccomp-bpf, Seatbelt, AppContainer) and minimize attack surface by locking down syscalls, IPC, files, sockets, and side channels. Perform threat modeling, respond to sandbox escape findings, and document tradeoffs between isolation strength, performance, and compatibility.

Loading

Loading job details...

Preparing the role view and application actions.

FursaFursa
Roblox
Roblox
3 days ago

Senior Security Software Engineer, Sandbox Platforms

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI
Last checked: 7 hours agoStatus: Live

Job Summary

Design and harden process sandboxes that isolate untrusted and semi-trusted code across Linux, macOS, and Windows. Build communication boundaries using platform primitives (e.g., nsjail/seccomp-bpf, Seatbelt, AppContainer) and minimize attack surface by locking down syscalls, IPC, files, sockets, and side channels. Perform threat modeling, respond to sandbox escape findings, and document tradeoffs between isolation strength, performance, and compatibility.
Location: San Mateo
Workplace: Onsite
Employment Type: Full time
Job Function: Software Engineering
Seniority: Mid level

Key Responsibilities

  • •Design and implement sandboxes using platform primitives across Linux, macOS, and Windows.
  • •Lock down and minimize all communication paths in and out of the sandbox (syscalls, IPC, shared memory, file descriptors, sockets, brokers).
  • •Enumerate and reduce attack surface, assuming the code inside is hostile.
  • •Make and document engineering tradeoffs between isolation strength, performance, compatibility, and maintainability.
  • •Write threat models, review designs, and respond to sandbox escapes and hardening findings.

Pay and Benefits

Salary: USD 269,170 - 326,060 annually
Equity and Bonus:Equity

Key Requirements

  • •Deep, hands-on knowledge of an OS security model (Linux, macOS, or Windows) and available sandboxing primitives.
  • •Strong attack surface analysis, including how sandbox escapes occur and how to reduce exposed pathways.
  • •Fluency in the boundary between sandbox and host (brokers, IPC, syscall filtering, privilege separation) and designing minimal, well-audited interfaces.
  • •Systems programming experience in C, C++, or Rust with comfort at the syscall and kernel-interface level.
  • •Security mindset focused on least privilege and distrust of inputs crossing the isolation boundary.
Skills:Threat modelingAttack surface analysisSystems thinkingDocumentationLeast privilege mindsetSecurity mindset
Tech Stack:LinuxMacOSWindowsNsjailSeccomp-bpfNamespacesCgroupsLandlockSeatbelt (sandbox_init / SBPL)AppContainerJob objectsRestricted tokensIntegrity levelsSyscallsIPCShared memoryFile descriptorsSocketsBrokersKernel

Eligibility

Visa:H-1B

Company Brief

Roblox
Operates an online platform for user-generated games and virtual experiences, enabling creators to build, publish, and monetize interactive 3D experiences for a global community of players.
Industry: Gaming
Company Size: Enterprise (1,001+ employees)
Revenue: USD 1B+
Growth: Public Company
Valuation: Public Company (Market Cap in USD)
Funding: IPO / Publicly Listed
Headquarters: San Mateo, United States
Founded: 2004
WebsiteLinkedIn