Mergers & Acquisitions Security Lead, Salesforce

• You are right for this job if you possess the unique skillset of product / infrastructure security testing skills partnered with excellent executive presence and communication
• Our ideal candidate has held a range of product security roles, has experience understanding business drivers and presenting to executive audiences, possesses strong written and verbal communication skills, creatively applies their technical acumen to a wide breadth of offensive and defensive security scenarios, is comfortable managing through ambiguity, and loves to get things done with an owner and driver mindset
• If you like wearing multiple hats, knocking down doors to peek into dark corners to uncover security tech debt, developing plans to remediate risk, constantly learning about new and cutting edge technologies, and working with a team of passionate and kind security experts, this is the perfect role for you
• Bachelor's Degree in Computer Science, Engineering, or related technical field, or equivalent experience in technical leadership
• 6+ years of experience in security testing, engineering, or technical assurance across applications, products, and infrastructure
• Experience with threat modeling SaaS product and infrastructure
• Strong IaaS security skills, with a focus on AWS and/or GCP. Familiarity with Azure and OCI a plus
• Experience with Linux systems engineering/operations; Understanding of Microsoft Windows Server/AD deployment
• Strong scripting/development skills (Python, Go, Ruby, Java, Node, etc)
• Deep knowledge of secure software development lifecycle; knowledge of CI/CD best practices
• Experience architecting, deploying, and maintaining security controls
• Experience performing code and infrastructure design reviews; experience fuzzing applications and protocols; assembly/exploit development experience
• Experience with multiple static and dynamic code analysis tools
• Experience in infrastructure vulnerability assessments and remediation; bug bounty awards or CVEs
• Excellent problem-solving, analytical, and communication skills. Must have experience explaining technical security concepts to non-technical and technical audiences
• Contributions to the community (open source, presentations, volunteering, etc)
• Bachelors' degree in an associated field (e.g. Information Technology, Computer Science, etc.) and/or advanced industry certifications (e.g. CISSP, CEH, CRISC, OCSP, CompTIA Security+, etc.)

Desirable

• Trust and security are Salesforce's number one value. We have built a mergers & acquisitions security integration team that is responsible for ensuring the security uplift of all Salesforce acquisitions
• The Mergers & Acquisitions Security Lead will work with potential acquisition targets and completed acquisitions to threat model their environment, uncover risks, identify and track mitigations, and transition the acquisition to other security teams for long-term integration ownership
• We are looking for an individual contributor that wants to leverage their deep product security, penetration testing, development, operations, and infrastructure skills in a fast-paced and elite security environment
• You will work with Salesforce and acquisition leadership and engineering teams to ensure product and infrastructure are secure. The work involved will be focused largely on product and infrastructure design and assessment, code review, threat modeling, assisting acquisition engineering teams integrating to Salesforce standards, and assisting acquisition engineering teams remediating issues uncovered during testing, among others
• Salesforce makes multiple acquisitions per year, and each acquisition represents the unknown, ensuring engaging and exciting work that will challenge you technically and provide great opportunities to grow your professional skill set
• As the M&A Security Lead Engineer, you are responsible for:
• Leading and conducting security diligence exercises for potential acquisition targets, including:
• Creating threat model of the target environment
• Leading a team of security engineers in penetration testing and security review of target source code, infrastructure, cloud accounts, and other assets
• Crafting and leading security-focused interviews with acquisition leadership and security resources
• Requesting and analyzing supplemental information to build a full picture of a target’s security posture and areas of weakness
• Identifying potential areas of risk and assessing their potential impact to Salesforce upon acquisition
• Modeling out the potential real and opportunity costs of security debt on overall business priorities and deal models
• Updating leadership and executives on status, findings, and potential risks throughout the exercise
• Escalating critical areas of risk to acquisition and Salesforce leadership; and
• Using diligence information to craft preliminary integration plans
• Leading security integrations of acquired companies, including:
• Using information discovered during diligence to craft detailed integration plans to drive the resolution of identified security debt
• Prioritizing work items in accordance with risk
• Negotiating with work teams to estimate associated effort and ensure committed timelines for development and required work
• Taking ownership for key milestones where possible and delegating or influencing partner engineering teams where not
• Keeping pulse on remediation progress, working to resolve blockers, escalate risks, and generally drive a fast pace of integration work; and
• Preparing acquired products for handoff to the wider Security team
• Developing thought leadership for the M&A team and wider Security team, including:
• Deeply understanding associated technical products and tooling that could enhance our M&A integration processes, identifying tooling gaps, assessing potential solutions, and generally advising the wider Security team on use, implementation, and evolution
• Developing deep expertise in Salesforce security domains, how to apply them to various types of acquisitions, how to more efficiently work with team members to drive integration efficiency, and generally advising the wider Security team on implementation and evolution
• Upleveling testing, integration, and technical application of security across Salesforce and acquisition environments