Senior Platform Abuse Prevention & Threat Engineer

Salesforce, Inc.; Bellevue (WA); On-site; USD 149,000 - 224,000; Full time

Job summary

Salesforce, Inc. is seeking a Platform Trust and Safety Engineer to identify and stop abusers who compromise Core CRM and Marketing Cloud. You will build detection rules, work with Legal on regulatory reporting, and help close detection gaps across products.

The role requires a related technical degree and strong experience in threat intelligence, incident response, and abuse investigations, with hands-on Splunk SPL and YARA skills. Expect collaboration across teams and on-call rotations.

Qualifications

• Extensive experience in information security roles involving platform abuse, threat intelligence, incident response, or threat detection.
• Experience managing security or abuse investigations end to end: triage, evidence collection, risk assessment, containment, escalation, and closure.
• Specialization in at least one of: log analysis, file-level forensics, or data mining.
• Experience authoring detection rules using languages such as YARA or Splunk SPL, and comfort working from a command line.

Responsibilities

• Review, triage, and respond to external and internal abuse reports across Core CRM and Marketing Cloud, with an eye toward expanding into new products.
• Build and tune detection and response rules in Splunk, and author and maintain automated response playbooks.
• Partner with our Office of Ethical Usage and Legal teams — including on regulatory reporting such as the EU Digital Services Act (DSA) — to keep our platforms free of malicious content.
• Identify and document anti-abuse tooling requirements for engineering teams, and evaluate third-party vendor tools to close detection gaps.

Skills

Threat intelligence

Incident response

Threat detection

Threat modeling

On-call rotation

Education

Related technical degree

Tools

YARA

Splunk SPL

Git/GitHub

Temporal

Job description

Salesforce, Inc. is seeking a Platform Trust and Safety Engineer to identify and stop abusers who compromise Core CRM and Marketing Cloud. You will build detection rules, work with Legal on regulatory reporting, and help close detection gaps across products.

The role requires a related technical degree and strong experience in threat intelligence, incident response, and abuse investigations, with hands-on Splunk SPL and YARA skills. Expect collaboration across teams and on-call rotations.