AppSec Director: SaaS Security & Risk Leadership

Salesforce, Inc.; Michigan; On-site; USD 171,000 - 273,000; Full time

Job summary

Salesforce, Inc. is seeking a Senior AppSec Consultant to lead enterprise security engagements across the SaaS lifecycle. You will scope, staff, and own risk-based remediation roadmaps while translating technical findings for executive stakeholders.

You'll advise on secure SDLC, threat modeling, OWASP Top 10, and secure IAM/API practices, partnering with account teams to shape pre-sales and delivery. This role requires strong leadership and hands-on expertise.

Qualifications

• 7-12+ years of AppSec experience (secure SDLC, vulnerability management, threat modeling, pen testing) - core, hands-on requirement.
• Deep knowledge of OWASP Top 10 and common app-layer vulnerabilities and practical mitigations.
• Practical SaaS security implementation — IAM, API security, data protection, and shared-responsibility model.

Responsibilities

• Apply AppSec expertise to lead and validate security engagements for enterprise customers.
• Identify and advise on vulnerabilities (OWASP Top 10, injection, access control, SSRF, insecure deserialization, etc.).
• Translate findings into prioritized remediation roadmaps for client stakeholders.
• Lead end-to-end delivery of security engagements—scoping, staffing, timeline, risk ownership.
• Partner with account teams on pre-sales—discovery, solution scoping, SOW, presentations.
• Advise C-suite and senior security stakeholders, translating risk into business terms.
• Oversee delivery teams to ensure consistent methodology and quality.
• Develop reusable delivery accelerators, playbooks grounded in AppSec best practice.
• Mentor staff on security substance and client-facing engagement skills.

Skills

AppSec experience

OWASP Top 10

SaaS security

Executive communication

Security certifications

Job description

Salesforce, Inc. is seeking a Senior AppSec Consultant to lead enterprise security engagements across the SaaS lifecycle. You will scope, staff, and own risk-based remediation roadmaps while translating technical findings for executive stakeholders.

You'll advise on secure SDLC, threat modeling, OWASP Top 10, and secure IAM/API practices, partnering with account teams to shape pre-sales and delivery. This role requires strong leadership and hands-on expertise.