Senior BISO - Product Security & Risk

100 Salesforce, Inc.; Bellevue (WA); On-site; USD 197,000 - 365,000; Full time

Job summary

Salesforce is seeking a seasoned BISO for its Product Security team, navigating a fast-paced SaaS and on‑premise security landscape. You will blend deep technical expertise with strong leadership to manage risk across cloud, infrastructure, and applications while collaborating with executives across business units.

Focus areas include secure coding, threat modeling, and third‑party risk, with active guidance on security backlog prioritization and governance.

Qualifications

• 10+ years of information security experience, with 5–10 years in leadership across cloud, infrastructure, applications, and third‑party integrations.
• Deep understanding of security principles across all tech layers, incl. cloud platforms, IAM, and risk management frameworks.
• Familiarity with security tools such as SIEM (Splunk), vulnerability scanners (Qualys, Nessus), and IAM solutions (Okta, SailPoint).
• Strong ability to work independently and drive security initiatives with executive stakeholders.

Responsibilities

• Lead security delivery across product security and risk governance for SaaS and on‑premise services.
• Prioritize and drive the security backlog with a broad set of executives and engineers.
• Articulate complex security concepts in business terms to influence decisions without direct authority.

Skills

Security leadership

Cloud security

Application security

Stakeholder management

Risk management

Security frameworks

Education

Related technical degree

Tools

Splunk

Qualys

Nessus

Okta

SailPoint

Job description

Salesforce is seeking a seasoned BISO for its Product Security team, navigating a fast-paced SaaS and on‑premise security landscape. You will blend deep technical expertise with strong leadership to manage risk across cloud, infrastructure, and applications while collaborating with executives across business units.

Focus areas include secure coding, threat modeling, and third‑party risk, with active guidance on security backlog prioritization and governance.