Senior Offensive Security Researcher — Lead Secure-by-Default

Salesforce, Inc.; San Francisco (CA); On-site; USD 149,000 - 224,000; Full time

Benefits offered by this job

Health benefits

401(k) plan

Employee stock purchase plan

Job summary

Salesforce, Inc. is seeking a Senior Offensive Security Researcher to lead security assessments and drive secure-by-default initiatives across our product portfolio. You’ll work with engineers to translate risk into actionable fixes and mentor teams on advanced offensive techniques.

You will influence architecture and design decisions from early development through deployment, ensuring robust security postures while balancing product velocity and user experience.

Qualifications

• 7+ years of experience in Application Security or Offensive Security with an attacker mindset.
• Demonstrated experience independently finding and remediating vulnerabilities in complex applications.
• Deep understanding of Web application security (OWASP Top 10 and beyond), Authentication & authorization flaws, API security, Injection attacks, logic flaws, and access control bypasses; Secure design and threat modeling.

Responsibilities

• Lead offensive security assessments (manual testing, code review, architectural analysis, threat modeling) across application ecosystems.
• Identify critical, high-impact, and systemic vulnerabilities alongside isolated issues.
• Drive security research to identify emerging attack vectors, abuse cases, and bypass techniques relevant to our applications and platforms.
• Partner with engineers to explain risk, impact, and exploitability; design and implement effective remediations; ensure fixes are scalable and maintainable.
• Lead Secure by Default initiatives by applying guardrails, patterns, and baseline controls; remediate insecure defaults.
• Influence designs early in the development lifecycle to prevent vulnerabilities before release.
• Mentor engineers and peers by sharing security knowledge and offensive techniques.
• Collaborate with detection, monitoring, and incident response teams to improve visibility into real-world exploitation.

Skills

OWASP Top 10

Threat modeling

Web application security

Authentication & authorization flaws

API security

Injection attacks

Secure design

Manual security testing

Security research

Mentoring engineers

Job description

Salesforce, Inc. is seeking a Senior Offensive Security Researcher to lead security assessments and drive secure-by-default initiatives across our product portfolio. You’ll work with engineers to translate risk into actionable fixes and mentor teams on advanced offensive techniques.

You will influence architecture and design decisions from early development through deployment, ensuring robust security postures while balancing product velocity and user experience.