Senior Security Auditor

Roblox•San Mateo, CA

11d•$170,200 - $204,580•Onsite

About The Position

As a Senior Security Auditor on Roblox's Internal Audit team, you will lead IT risk evaluations, audits, and readiness exercises across the company's internal technology environment. You will advance information security and privacy compliance while helping scale operational objectives, including designing and building AI-integrated audit programs. Reporting to the IT Audit Senior Manager, you will partner with Engineering, Information Security, Legal, Trust & Safety, and Finance to help build a secure and resilient ecosystem. The role includes establishing and operationalizing an audit program to address CCPA cybersecurity audit requirements; using AI tools and offshore resources to test security controls; executing privacy audits; analyzing IT and information security data; and developing repeatable audit methods and internal compliance knowledge. You will also guide the adoption of compliance processes and controls, track remediation of audit findings, prepare reports, support integrated compliance requirements, and contribute to automation and tool implementation.

Requirements

Bachelor's degree in Information Technology, Information Systems, Computer Science, or a related technical field, or equivalent experience.
At least 5 years of professional IT audit experience.
At least 2 years of security audit or security compliance experience.
Solid technical knowledge of multiple security and privacy compliance frameworks, including CCPA, NIST, ISO 27001, SOC 2, and PCI DSS.
Compliance and risk management skills.
Beginner-to-intermediate knowledge of scripting languages such as SQL, Python, or shell scripting.
Ability to use AI tools in audit testing and daily operations.

Nice To Haves

CISSP, CISM, CIPP, or CISA certification.

Responsibilities

Establish and operationalize an audit program to meet CCPA cybersecurity audit requirements, including scoping, risk assessment, gap analysis, audit execution, remediation tracking, and reporting.
Use AI tools and offshore resources to test the design and operating effectiveness of controls across security domains, including access controls, data classifications, vulnerability management, production engineering security, cloud security, data security, endpoint security, and network security.
Execute and support privacy audits to address regulatory requirements, benchmark against industry best practices, identify compliance improvements, and streamline processes through automation.
Lead ad hoc analyses of IT and information security data to support risk-based operational audits.
Establish repeatable methods to ensure consistent results, stay current on evolving regulations, and develop an internal knowledge base on security compliance.
Guide identification and implementation of processes and controls required by regulatory compliance frameworks, and remediation of corrective action plans related to audit findings.
Develop audit reports summarizing findings and associated risks, identifying action owners, and aligning remediation plans with management.
Work with cross-functional teams, including Engineering, Information Security, Legal, Trust & Safety, and Finance, to create integrated compliance requirements.
Assist with internal automation efforts and tool implementations.