Product Security Senior

Description

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts.

Job Category

Product

Job Details

About Salesforce

Salesforce is the 1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all.

Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce.

The Experience

Salesforce's Platform Security team protects the foundational platform our customers, partners, and developers build on, balancing deep security expertise with the agility our business depends on. We're hands-on security engineers who thrive on close collaboration with Product and Engineering across the software development lifecycle, trusted for the technical depth we bring to keep the world's 1 CRM platform secure.

This role is a senior product security engineer for the platform's integration and service-connectivity layer, including events, messaging, connectors, APIs, and service-to-service pathways that move customer data across trust boundaries to other internal or external systems. It also covers the fast-growing agent and connector integrations that let external tools and models talk to the platform. You'll surface concrete security risk in ambiguous system designs, drive mitigation for root causes in the layers where they should be fixed, and keep a fast-moving Engineering org shipping safely through threat modeling, design and code reviews, and secure-by-default guidance.

What You'll Actually Be Doing

Own security assurance for critical backend and integration areas, driving threat modeling and security design reviews across the platform's event and integration pathways, connectors, service-to-service connectivity, and the APIs that carry data across trust boundaries.

Secure service-to-service and connector trust boundaries, driving secure design and implementation for service-to-service authentication, external client apps, and agent and Model Context Protocol (MCP) connectors, where excessive privilege, confused-deputy risk, and secret leakage are first-class threats.

Review source code in depth (Java, plus JavaScript/TypeScript or platform-hosted code as needed) in a large codebase to validate design assumptions and discover risk in authentication, integration, and access-control flows, tracing issues back to their true root cause so fixes land at the right layer.

Partner with architects, engineers, and product owners to move findings to resolution, push secure-by-default patterns into frameworks and onboarding paths, and coach junior security engineers on secure design and threat modeling.

You're Our Person If...

You have hands-on experience securing backend, integration, or service-connectivity systems, with deep expertise in API security (REST/GraphQL authentication, external exposure, rate-limiting, input validation) and secure code review.

You can threat-model a system's design to surface concrete security risk rather than enumerate a checklist, tracing issues to their technical, architectural, or organizational root cause.

You have advanced knowledge of authorization and complex permission/scope models and service-to-service authentication, plus working familiarity with delegated-authorization flows such as OAuth 2.0, OpenID Connect (OIDC), and JSON Web Tokens (JWT).

You can review and analyze Java source code and at least one other language (JavaScript/TypeScript, Python, or Go), including tracing large or legacy codebases, and you have 5+ years in product, application, or platform security operating independently on problems of moderate-to-high complexity.

Even Better If...

You've secured eventing, messaging, integration, or API platforms at scale.

You have hands-on connector security, agent integration, or MCP experience, including reasoning about trust boundaries for agentic systems beyond basic prompt injection.

You have multi-tenant SaaS backend security architecture experience at the application layer.

You've served as the embedded security subject-matter expert for a product area.

Unleash Your Potential

When you join Salesforce, you’ll be limitless in all areas of your life. Our benefits and resources support you to find balance and be your best , and our AI agents accelerate your impact so you can do your best . Together, we’ll bring the power of Agentforce to organizations of all sizes and deliver amazing experiences that customers love. Apply today to not only shape the future — but to redefine what’s possible — for yourself, for AI, and the world.