Principal Security Software Engineer, Anti-Cheat

As a Principal Security Software Engineer, Anti-Cheat on our Game Client Engineering Team, you’ll be a key defender at the forefront of Roblox’s security. Every day, you’ll take on sophisticated hackers around the world who attempt to exploit and manipulate our platform. We rely on your expertise to uncover and analyze new threats, implement robust protective layers to fortify our client, and work closely with engineering partners to make our defenses stronger, smarter, and more resilient. This is a role for those passionate about taking on real-world security challenges and building systems that stop attackers in their tracks.

You will:

• Detect and Neutralize Threats: Identify, analyze, and reverse engineer exploits, vulnerabilities, and cheat mechanisms used against our platform, devising effective countermeasures to safeguard our community.
• Architect Robust Defenses: Design and implement advanced anti-tamper and anti-cheat systems directly within the Roblox client, elevating its resilience against current and future threats.
• Collaborate Cross-Functionally: Partner closely with engineering, Trust and Safety, and infrastructure teams to ensure seamless integration of security features, and drive alignment on best practices for platform protection.
• Lead Innovation in Client Hardening: Pioneer new methods to protect our client, from memory protection to code obfuscation and beyond, anticipating and mitigating potential exploits.
• Monitor and Adapt: Stay ahead of emerging threats by continuously analyzing hacker behavior and adapting protection strategies to maintain our lead in the evolving security landscape.
• Mentor and Guide: Support the growth of junior engineers through knowledge sharing and mentorship, fostering a culture of proactive security within the team.

You have:

• Mobile Security Expertise: Significant experience in Android security and mobile threat modeling, with a deep understanding of client hardening, anti-tamper mechanisms, and exploit mitigation techniques.
• Low-Level Systems Knowledge: Proven ability in low-level systems programming, including hands-on experience with operating system internals and reverse engineering. Familiarity with ARM assembly is a strong advantage!
• Programming Proficiency: Skilled in C/C++ for native Android development, with working knowledge of Java. Able to write high-performance code that is secure, maintainable, and efficient on resource-limited mobile platforms.
• Security System Engineering: Demonstrated experience architecting and implementing security features for mobile or embedded systems, ideally within the gaming or app security space.
• iOS Development Experience: While Android expertise is critical, experience with iOS development is a plus, as it broadens the potential for cross-platform security solutions.
• Embedded Systems and Malware Analysis: Familiarity with embedded systems security, binary analysis, and malware detection methods is beneficial for tackling advanced anti-cheat challenges.

You are:

• A Hacker at Heart: You’ve been uncovering vulnerabilities and finding security flaws in software since your early days, with a passion for staying one step ahead of potential attackers.
• A Low-Level Software Engineer: You’re well-versed in the depths of operating systems, with hands-on experience in kernel APIs, executable file formats, debugging tools, assembly, and calling conventions.
• Mobile Security Expert: Android is your specialty, with expertise in securing mobile applications, working with Android OS internals, and implementing advanced anti-tamper and anti-cheat techniques. Knowledge of iOS security is a plus!
• Proficient in Reverse Engineering: You can dissect and analyze code, identifying potential vulnerabilities and understanding attacker methods, with practical skills in ARM assembly and binary analysis.
• A Collaborative Problem Solver: You thrive on working closely with cross-functional teams, translating complex security challenges into practical solutions that protect our users and platform.