Senior Security Software Engineer, Sandbox Platforms

📋 Description

• Design and implement sandboxes using platform primitives: nsjail, seccomp-bpf, namespaces, cgroups
• Define and lock down every communication path in and out of the sandbox: syscalls, IPC, shared
• Enumerate and reduce attack surface: kernel syscall surface, broker interfaces, device access, and
• Make deliberate engineering tradeoffs between isolation strength, performance, compatibility, and
• Write threat models, review designs, and respond to sandbox escapes and hardening findings.

🎯 Requirements

• Deep, hands-on knowledge of the OS security model on at least one of Linux, macOS, or Windows, and
• Strong grasp of attack surface analysis: how sandboxes are escaped and how to shrink the ways in.
• Fluency in the boundary between sandbox and host (brokers, IPC, syscall filtering, privilege
• Systems programming in C, C++, or Rust; comfort at the syscall and kernel-interface level.
• Sound judgment on tradeoffs: knowing when tighter isolation is worth the cost and when it isn't.
• A security mindset: you default to least privilege and distrust every input crossing the boundary.

🎁 Benefits

• Full-time employees eligible for equity compensation
• Benefits as described on https://careers.roblox.com/total-rewards