Senior Product Security

Who you are

• You have hands-on experience securing backend, integration, or service-connectivity systems, with deep expertise in API security (REST/GraphQL authentication, external exposure, rate-limiting, input validation) and secure code review
• You can threat-model a system's design to surface concrete security risk rather than enumerate a checklist, tracing issues to their technical, architectural, or organizational root cause
• You have advanced knowledge of authorization and complex permission/scope models and service-to-service authentication, plus working familiarity with delegated-authorization flows such as OAuth 2.0, OpenID Connect (OIDC), and JSON Web Tokens (JWT)
• You can review and analyze Java source code and at least one other language (JavaScript/TypeScript, Python, or Go), including tracing large or legacy codebases, and you have 5+ years in product, application, or platform security operating independently on problems of moderate-to-high complexity
• You've secured eventing, messaging, integration, or API platforms at scale
• You have hands-on connector security, agent integration, or MCP experience, including reasoning about trust boundaries for agentic systems beyond basic prompt injection
• You have multi-tenant SaaS backend security architecture experience at the application layer
• You've served as the embedded security subject-matter expert for a product area

What the job involves

• Salesforce's Platform Security team protects the foundational platform our customers, partners, and developers build on, balancing deep security expertise with the agility our business depends on
• We're hands-on security engineers who thrive on close collaboration with Product and Engineering across the software development lifecycle, trusted for the technical depth we bring to keep the world's #1 CRM platform secure
• This role is a senior product security engineer for the platform's integration and service-connectivity layer, including events, messaging, connectors, APIs, and service-to-service pathways that move customer data across trust boundaries to other internal or external systems
• It also covers the fast-growing agent and connector integrations that let external tools and models talk to the platform
• You'll surface concrete security risk in ambiguous system designs, drive mitigation for root causes in the layers where they should be fixed, and keep a fast-moving Engineering org shipping safely through threat modeling, design and code reviews, and secure-by-default guidance
• Own security assurance for critical backend and integration areas, driving threat modeling and security design reviews across the platform's event and integration pathways, connectors, service-to-service connectivity, and the APIs that carry data across trust boundaries
• Secure service-to-service and connector trust boundaries, driving secure design and implementation for service-to-service authentication, external client apps, and agent and Model Context Protocol (MCP) connectors, where excessive privilege, confused-deputy risk, and secret leakage are first-class threats
• Review source code in depth (Java, plus JavaScript/TypeScript or platform-hosted code as needed) in a large codebase to validate design assumptions and discover risk in authentication, integration, and access-control flows, tracing issues back to their true root cause so fixes land at the right layer
• Partner with architects, engineers, and product owners to move findings to resolution, push secure-by-default patterns into frameworks and onboarding paths, and coach junior security engineers on secure design and threat modeling

Benefits

• Medical Care
• Life Insurance
• Retirement Savings
• Employee Assistance Programs
• With 9 standard holidays and four floating holidays, you get a total 13 paid days off each year