Principal Security Software Engineer, IAM

About the Role

As a Principal Security Software Engineer on the Production IAM team, you will set the technical direction for how identity and access work across Roblox's production infrastructure, from mTLS-based service identity to privileged access controls governing engineer access to production.

The team is accountable for Roblox's machine and workload identity platform, centralized authorization engine, production access management platform, production PKI, certificate lifecycle, and just-in-time privileged access. You will define multi-year strategy, align across Roblox Platform, mentor senior and staff engineers, build core systems, and establish identity patterns for AI agents.

Responsibilities

• Lead production identity and access architecture: Define and evolve end-to-end design for machine, workload, human, and AI-agent identity across hybrid on-prem and cloud fleet.
• Drive mTLS and workload identity: Lead technical strategy for the SPIFFE/SPIRE-based identity platform, service-mesh integration, managed service accounts, and certificate issuance/storage/rotation.
• Advance just-in-time, least-privilege access: Architect short-lived, auditable, and break-glass production access that remains reliable during outages.
• Evolve authorization engine: Mature centralized authorization and access-control models (RBAC/ABAC and risk-based access).
• Pioneer AI agent identity: Define how autonomous agents obtain credentials, receive scoped permissions, and manage sessions.
• Technical leadership: Author RFCs, align stakeholders across Roblox Platform, mentor engineers, and participate in design reviews, hiring, and on-call ownership.

Qualifications

• 8+ years of professional experience building scalable, distributed backend systems with end-to-end architecture ownership.
• Deep expertise in identity and access management (IAM), including authentication, authorization, and models like RBAC, ABAC, or risk-based access control.
• Hands-on experience with several of: PKI, certificate/key lifecycle management, mTLS, SPIFFE/SPIRE or comparable workload-identity systems, service mesh, secret management (e.g., Vault), and privileged access management (PAM).
• Proficiency in at least one systems language (e.g., Go, Rust, Java, C++, Python, or C# .NET).
• Demonstrated track record leading technical direction across teams and writing influential design documents.
• AI fluency, including practical use of AI tools, understanding LLM capabilities/limitations, and reasoning about agent identity and access.
• Bachelor's degree in Computer Science, Computer Engineering, or a similar technical field, or equivalent experience.

Work Arrangement

• Roles based at the San Mateo headquarters require onsite attendance Tuesday, Wednesday, and Thursday, with optional presence on Monday and Friday.