Senior Security Operations Engineer

Work Environment: This role is based in London, UK. You will be working from a dedicated, private space located within a shared office environment, designed to enable collaboration while remaining secure.

You will:

• Exercise High Autonomy: Act as the primary Incident Commander for the European time zone, making critical, time-sensitive decisions independently before US HQ comes online. You will serve as the senior-most security operations point of contact in the region.
• Command Security Incidents: Ensure serious threats and impacts are understood, mitigated, and learned from with speed and professionalism, often leading responses end-to-end without immediate escalation paths during local hours.
• Drive Strategy & Operations: Go beyond individual contribution to shape the strategic direction of the SIRT/SOC function, specifically identifying how global hand-offs and "follow-the-sun" models can be optimized.
• Conduct Advanced Investigations: Dig into complex context, determining if threats exist and taking decisive action to prevent them.
• Collaborate Cross-Functionally: Work with Legal, HR, Executive teams, and external partners (Developers & Customers). You will also travel semi-regularly to the USA to visit HQ, ensuring deep alignment with central engineering and security leadership.
• Lead High-Profile Responses: Collaborate with Security and Engineering to lead responses to major vulnerabilities or platform-wide events.
• Build & Automate: Produce and refine security response procedures (runbooks, IRPs, workflows) with a focus on automation to reduce manual toil.
• Threat Hunt: Proactively hunt for anomalous activity in our signals, distinguishing between outliers and threats.

You have:

• Experience: 10+ years of experience across Infosec, IT, Infra/SRE, and/or Incident Response.
• Specialization: 7+ years of experience specifically in Detection or Response (& Incident Response) roles.
• Autonomous Leadership: Proven ability to work independently in satellite offices or distributed teams. You are comfortable being the "person in charge" during your shift and making calls that impact the business.
• Incident Command: Extensive experience operating as an incident commander. You can flex into deep engineering work but also possess the executive presence to coordinate responders and communicate status to leadership.
• Investigations: Expert-level capability in investigating threats in enterprise and production environments, taking ownership from identification to resolution.
• Knowledge/Tools/Techniques: Deep understanding of security tools (SIEM, EDR, IDS/IPS, NDS, SOAR). You are proficient in applying Incident Response frameworks (NIST IR Lifecycle, Cyber Kill Chain, MITRE ATT&CK) to real-world scenarios. Collaborate effectively with engineering colleagues, leveraging extensive expertise across various infrastructure and technologies (Public Cloud, OS, Virtualization, Containerization, Networking, Build/Development infrastructure, and Hardware).
• Education: Bachelor's degree in Computer Science, Cybersecurity, or a related technical field; advanced degree preferred or equivalent experience.

You are:

• A Strategic Self-Starter: You don't wait for instructions. You identify gaps in coverage—especially those unique to regional or time-zone specific challenges—and fix them.
• Detailed Thinker: You enjoy exploring the details and considering the second and third-order effects of your decisions.
• Eager Problem Solver: You are drawn to complex issues rather than avoidant of them.
• Emboldened to Make Change: You instinctively ask what you can do to improve the situation rather than waiting to be prompted.
• Compelled by our Mission: You are driven by the opportunity to protect our community and the safe space we’ve created.
• A Calculated Risk Taker: You move fast, navigating reasonable risks to take action and build capabilities as quickly as possible.

Roles that are based in an office are onsite Tuesday, Wednesday, and Thursday, with optional presence on Monday and Friday (unless otherwise noted).

Roblox provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Roblox also provides reasonable accommodations to candidates with qualifying disabilities or religious beliefs during the recruiting process.

For US based roles only, please note the Company may not be able to employ candidates for this role who have United States work authorization related to certain U.S. visa categories, or support future H-1B sponsorship at this time.