Product Security Senior, Salesforce

• 5+ years in security engineering, application security, or a directly adjacent role. At least 2 of those years in a hands-on vulnerability-discovery capacity
• Deep familiarity with at least one major language ecosystem (Java, Python, JavaScript/TypeScript, Go, Ruby, or similar) and the ability to read and reason about code in others
• Working knowledge of static analysis tooling and how custom rules are authored, tuned, and maintained. Semgrep, CodeQL, or equivalent
• Practical experience with at least one of: threat modeling, authentication and authorization design, cloud security architecture, or supply chain security
• Comfort operating in ambiguity.; You should be able to scope your own work from a vague ask
• Excellent communication both written and verbal
• A related technical degree required

Desirable

• Product Security at scale is changing. Frontier AI models can now reason about code the way skilled attackers do, and the security engineers who work alongside product teams have a new set of tools, a new set of threats, and a new set of decisions to make. This role sits at the center of that shift
• You will work directly with product engineering teams to find, validate, and prevent security vulnerabilities across a very large enterprise software portfolio
• The engineering surface is broad: application code, cloud services, APIs, authentication and authorization systems, third-party dependencies
• The tooling is evolving fast: agentic scanners, custom static analysis, dynamic validation, and detection engineering. You will be one of a small number of senior engineers whose judgment on what is real, what is exploitable, and what is worth fixing is trusted by product teams and by leadership
• Use agentic security systems, custom static analysis, manual review, and threat modeling to surface real risk. Every technique has failure modes; you know which one to reach for
• A finding is not a bug until someone shows it can actually be triggered. You will spend real time on validation; sometimes manually, sometimes by extending automated tooling to do more of the work. Reducing the manual validation cost of the program is an explicit engineering goal
• When a class of vulnerability shows up more than once, the answer is not to file the same bug thirty times. It is to author a static analysis rule that blocks the class at pull-request time
• You will contribute to the intake pipeline that graduates high-value findings into merge-blocking rules, and you will have opinions on which findings clear the rule-worthy bar and which do not
• Security consulting on hard architectural questions
• You will use and extend this scoping methodology across the products you work on
• Your impact is measurable - Detections shipped. Vulnerabilities closed. Systemic patterns eliminated