Product Security Lead
Salesforce23 hours ago
Dublin, IrelandStaff+
Responsibilities
- Lead security architecture, design reviews, code reviews, and threat modeling for cloud features and services.
- Drive remediation of vulnerabilities from penetration tests, bug bounty programs, and ASA findings while owning SLAs and risk acceptance.
- Design and drive controls for authentication and authorization weaknesses, storefront abuse, credential stuffing, bot traffic, and API abuse.
- Advise on multi-tenant isolation, authentication and authorization, secrets and key management, and PCI-relevant payment flows.
- Partner with Detection & Response on product-context security and serve as an escalation point for security incidents and customer security questions.
- Influence security roadmaps across Commerce and Trust, brief leadership on risk posture, and recommend short- and long-term remediation plans.
- Mentor engineers and security champions and improve secure software development lifecycle practices.
Requirements
- 7+ years of experience in application, product, or cloud security.
- Deep knowledge of web and API security, including OWASP, OAuth/OIDC, and SSO.
- Experience securing e-commerce and SaaS platforms, payments, and headless/storefront architectures.
- Experience reviewing multi-tenant SaaS platforms and enforcing tenant or organizational data isolation.
- Familiarity with software supply-chain security, dependency analysis, artifact provenance, build systems, and vulnerability-management workflows.
- Strong threat modeling and secure code review skills, with fluency in Java, JavaScript, and Node ecosystems.
- Experience securing public-cloud infrastructure including AWS, Hyperforce, Kubernetes, and GCP, plus familiarity with logging and detection pipelines.
- Experience securing AI-enabled product features, including prompt and tool boundaries, data access, agent authorization, and indirect prompt-injection risks.
- Ability to influence senior engineers and leaders without direct authority and communicate risk clearly.
- History of responsible vulnerability research and security tooling development.
- Preferred: familiarity with commerce platforms, bot mitigation, or fraud and abuse prevention.
- Preferred: relevant certifications such as CISSP, GIAC, or OSCP.
- Preferred: experience running or triaging bug bounty programs.
- Preferred: conference presentations, publications, or contributions to the security community.
Benefits
- Salesforce describes benefits and resources intended to support balance and personal well-being.
- Salesforce provides reasonable accommodations during the application and recruiting process.
Categories
About Salesforce
Salesforce builds cloud-based customer relationship management software and a broader Customer 360 platform for sales, service, marketing, commerce, and analytics, sold by subscription to businesses and public-sector organizations. Founded in 1999 and headquartered in San Francisco, it trades on the NYSE under the symbol CRM. Its portfolio includes Sales Cloud, Service Cloud, Marketing Cloud, MuleSoft integration, Tableau analytics, and Slack for collaboration, with extensive developer tools and APIs.