Product Security Lead - Core Platform Security
Salesforce5 days ago
Base Salary
$173k - $286k/yr
Responsibilities
- Lead security assurance for web, UI, runtime, rendering, and data-access API layers through threat modeling, security design reviews, and code reviews.
- Design platform-level mitigations for XSS, CSRF, SSRF, injection, broken access control, and related recurring weaknesses.
- Serve as the security lead for multi-release, cross-team programs involving guest access, third-party surfaces, and agent-facing products.
- Address AI and agentic risks including prompt injection, excessive agency, tool abuse, memory poisoning, and MCP connector security.
- Design approval workflows, least-privilege tool scoping, audit logging, and short-lived scoped credentials.
- Create secure patterns for frameworks, SDKs, and rendering pipelines; author security standards and mentor developers.
Requirements
- 8+ years of experience in product, application, or platform security.
- Bachelor’s degree in Computer Science, Engineering, or a related field, or equivalent practical experience.
- Deep expertise in web and application security, including OWASP injection classes, XSS, CSRF, SSRF, broken access control, and browser security.
- Hands-on experience securing modern UI frameworks, web runtimes, rendering pipelines, and guest or unauthenticated surfaces.
- Experience securing GraphQL and REST APIs, including authentication, cross-tenant data exposure, and expensive-query abuse.
- Experience leading threat modeling across complex web, UI, or data-access environments and driving findings to resolution.
- Understanding of AI and LLM risks in production, including prompt injection, tool abuse, MCP connector security, and controls protecting sensitive data.
- Ability to review JavaScript or TypeScript and at least one additional language such as Java, Python, or Go.
- Experience writing security standards, leading cross-team programs, and influencing experienced developers.
- Preferred experience securing UI frameworks or data-access APIs at scale for large multi-tenant SaaS products.
- Preferred hands-on experience with LLM application security or agent frameworks.
- Bug bounty or red-team experience is preferred.
Benefits
- Hybrid work arrangement based in San Francisco, CA, or Seattle/Bellevue, WA.
- Time off programs, medical, dental, and vision coverage.
- Mental health support, paid parental leave, life and disability insurance.
- 401(k) and employee stock purchasing program.
- Reasonable accommodation support and equal opportunity employment practices.
Tech Stack
Categories
About Salesforce
Salesforce builds cloud-based customer relationship management software and a broader Customer 360 platform for sales, service, marketing, commerce, and analytics, sold by subscription to businesses and public-sector organizations. Founded in 1999 and headquartered in San Francisco, it trades on the NYSE under the symbol CRM. Its portfolio includes Sales Cloud, Service Cloud, Marketing Cloud, MuleSoft integration, Tableau analytics, and Slack for collaboration, with extensive developer tools and APIs.