R
Roblox
Senior Security Software Engineer (Sandbox Platforms)
Skills
RustLinux
1 month ago
Share this opportunity
Share this opportunity to other talents of your network:
✓ Offer them a visibility boost with clients.
✓ Help your contacts find their next job.
Important information
Contract type:
Permanent
Salary:
$269,170 – $326,060 / year
Location:
United States
Work mode:
Onsite
Published on:
25 September 2026
What they need
- We build the isolation layers that contain untrusted and semi-trusted code
- You will design, build, and harden process sandboxes across one or more of Linux, macOS, and Windows, the last line of defense when something inside goes wrong
- This is a deep systems role for someone who thinks in terms of attack surface, threat models, and the exact boundary between trusted and untrusted
- Design and implement sandboxes using platform primitives: nsjail, seccomp-bpf, namespaces, cgroups, and Landlock on Linux; the Seatbelt (sandbox_init / SBPL) and related mechanisms on macOS; AppContainer, job objects, restricted tokens, and integrity levels on Windows
- Define and lock down every communication path in and out of the sandbox: syscalls, IPC, shared memory, file descriptors, sockets, brokers, and minimize what each one exposes
- Enumerate and reduce attack surface: kernel syscall surface, broker interfaces, device access, and side channels
- Assume the code inside is hostile
- Make deliberate engineering tradeoffs between isolation strength, performance, compatibility, and maintainability, and document the reasoning
- Write threat models, review designs, and respond to sandbox escapes and hardening findings- Deep, hands-on knowledge of the OS security model on at least one of Linux, macOS, or Windows, and the sandboxing primitives that platform provides
- Fluency in the boundary between sandbox and host (brokers, IPC, syscall filtering, privilege separation) and how to design a minimal, well-audited interface
- Systems programming in C, C++, or Rust; comfort at the syscall and kernel-interface level
- A security mindset: you default to least privilege and distrust every input crossing the boundary
- Sound judgment on tradeoffs: knowing when tighter isolation is worth the cost and when it isn’t
- Strong grasp of attack surface analysis: how sandboxes are escaped and how to shrink the ways in
- Kernel, hypervisor, or low-level OS internals work
- Experience across more than one of the three platforms
- Fuzzing, exploit development, or red-team experience against isolation boundaries
Other offers great for you!
These companies are also looking for great profiles
N
NGC x OPTIMA
Ingénieur Logiciel embarqué
Freelance
Cergy, France
Hybrid, Onsite
Skills
AUTOSARBSW
1 month ago
Quick apply
A
Auratem
Ingénieur logiciel sénior Python / IA
500
Freelance
77186 Noisiel, France
Hybrid
Skills
PostgreSQLLinuxPythonragLLM
16 days ago
Quick apply
S
Salutech
Ingénieur Logiciel IA
Freelance
Paris, France
Onsite, Hybrid
Skills
DockerPythonTesting & QAKubernetesSoftware refactoringCI/CDObservabilityAsynchronous programming
8 days ago
Quick apply
No company information available.