Product Security Lead

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts.

Job Category

Product

Job Details

About Salesforce

Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all.

Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce.

The Experience

You will be the embedded security authority for Salesforce Clouds including e-commerce and marketing area. You will work with engineering, architecture and BISO partners to make the products secure by design and resilient against real-world attacks on AI, APIs and the tenant environment.

What You'll Actually Be Doing

• Lead security architecture and design reviews, code reviews and threat modeling for Cloud features and services.
• Drive remediation of vulnerabilities from pen tests, bug bounty and ASA findings. Own SLAs and risk acceptance.
• Design and drive controls against Authentication and authorization weaknesses , storefront abuse, credential stuffing, bot traffic and API abuse.
• Partner with Detection & Response on the security with product context
• Advise on multi-tenant isolation, authentication and authorization, secrets and key management, and PCI-relevant payment flows.
• Act as the escalation point of contact for security incidents and customer security questions as product security advisory. Brief leadership on risk posture. Suggest short term, long term remediation plans.
• Influence Security roadmaps across Commerce and Trust. You will remain close to the code and architecture while multiplying the effectiveness of other security and engineering teams.
• Mentor engineers and security champions, and improve secure SDLC practices.

You're Our Person If...

• 7+ years in application, product or cloud security, with deep knowledge of web and API security (OWASP, OAuth/OIDC, SSO).
• Experience securing e-commerce and SaaS platforms, including payments , headless/storefront architectures.
• Experience reviewing multi-tenant SaaS platforms and enforcing tenant, or organizational data isolation.
• Familiarity with secure software-supply-chain practices, dependency analysis, artifact provenance, build systems, and vulnerability-management workflows.
• Strong threat modeling and secure code review skills. Fluent in Java/JavaScript/Node ecosystems.
• Experience securing Public-cloud infrastructure (AWS/Hyperforce, Kubernetes, GCP) and familiarity with logging and detection pipelines.
• Experience securing AI-enabled product features, including prompt and tool boundaries, data access, agent authorization, and indirect prompt-injection risks.
• Ability to influence senior engineers and leaders without direct authority, and communicate risk clearly.
• A history of responsible vulnerability research, security tooling development

Even Better If...

• Familiarity with Commerce platforms, bot mitigation, or fraud and abuse prevention.
• Relevant certifications (CISSP, GIAC, OSCP etc).
• Experience running or triaging bug bounty programs.
• Conference presentations, Publications, or Contributions to the Security Community.

Unleash Your Potential

When you join Salesforce, you’ll be limitless in all areas of your life. Our benefits and resources support you to find balance and be your best, and our AI agents accelerate your impact so you can do your best. Together, we’ll bring the power of Agentforce to organizations of all sizes and deliver amazing experiences that customers love. Apply today to not only shape the future — but to redefine what’s possible — for yourself, for AI, and the world.

Accommodations

If you need a reasonable accommodation during the application or the recruiting process, please submit a request via this Accommodations Request Form.

Please note that Salesforce uses artificial intelligence (AI) tools to help our recruiters assess and evaluate candidates’ resumes and qualifications throughout the recruiting process. Humans will always make any candidate selection and hiring decisions. Please see our Candidate Privacy Statement for more information about how we use your personal data and your rights, including with regard to use of AI tools and opt out options.

Posting Statement

Salesforce is an equal opportunity employer and maintains a policy of non-discrimination with all employees and applicants for employment. What does that mean exactly? It means that at Salesforce, we believe in equality for all. And we believe we can lead the path to equality in part by creating a workplace that’s inclusive, and free from discrimination. Know your rights: workplace discrimination is illegal. Any employee or potential employee will be assessed on the basis of merit, competence and qualifications – without regard to race, religion, color, national origin, sex, sexual orientation, gender expression or identity, transgender status, age, disability, veteran or marital status, political viewpoint, or other classifications protected by law. This policy applies to current and prospective employees, no matter where they are in their Salesforce employment journey. It also applies to recruiting, hiring, job assignment, compensation, promotion, benefits, training, assessment of job performance, discipline, termination, and everything in between. Recruiting, hiring, and promotion decisions at Salesforce are fair and based on merit. The same goes for compensation, benefits, promotions, transfers, reduction in workforce, recall, training, and education.