Product Security Lead: AI & UI Security Architect

Salesforce; San Francisco (CA); On-site; USD 173,000 - 260,000; Full time

Job summary

Salesforce is seeking a Platform Security Engineer to lead the security assurance for the UI/experience layer of the platform. You will coordinate threat modeling, security design reviews, and code reviews across web frameworks, runtimes, and rendering surfaces.

You will own AI and agentic risk, define least-privilege access, and shape secure-by-default patterns for guest-user data access and external integrations.

Qualifications

• Deep expertise in web/application security and the security of modern UI frameworks, web runtimes, or data-access APIs.
• Threat-modeling experience across complex web, UI, or data-access environments.
• Ability to review JavaScript/TypeScript plus at least one other modern language (Java, Python, or Go).

Responsibilities

• Lead security assurance for the experience and UI layer, driving threat modeling, security design reviews, and targeted code review across web and UI frameworks, runtimes, rendering pipelines, and data-access APIs.
• Serve as the standing security lead for multi-quarter, multi-team programs expanding guest-user data access, rendering experiences into surfaces we don't control, and the trust model for agent-facing products.
• Push secure patterns into frameworks, SDKs, and rendering pipelines; author security standards adopted by other teams for web/UI security, guest-user data access, and rendering trust boundaries.
• Own AI and agentic risk; mitigate prompts, excess agency, and memory poisoning; design human-in-the-loop gates for high-risk actions; define least-privilege scoping, audit logging, and short-lived credentials.

Skills

Web security

Threat modeling

Security reviews

JavaScript/TypeScript

Java

Python

Go

Security standards

Cross-team leadership

Tools

GraphQL

Job description

Salesforce is seeking a Platform Security Engineer to lead the security assurance for the UI/experience layer of the platform. You will coordinate threat modeling, security design reviews, and code reviews across web frameworks, runtimes, and rendering surfaces.

You will own AI and agentic risk, define least-privilege access, and shape secure-by-default patterns for guest-user data access and external integrations.