Senior Product Security Engineer — AI/Cloud Defender

100 Salesforce, Inc.; Bellevue (WA); On-site; USD 149,000 - 224,000; Full time

Benefits offered by this job

Time off programs

Medical

Dental

Vision

Mental health support

Paid parental leave

Life and disability insurance

401(k)

Employee stock purchasing program

Job summary

Salesforce is seeking an experienced security engineer to join the agentforce security team. You will work with product engineering to surface, validate, and prevent vulnerabilities across a large software portfolio, using agentic scanners, static analysis, and manual review.

You will evaluate findings, write static analysis rules, and contribute to the intake pipeline. This role requires deep language experience and the ability to scope work in ambiguity while communicating clearly.

Qualifications

• 5+ years of security engineering, application security, or equivalent.
• At least 2 years in vulnerability-discovery.
• Familiarity with Java, Python, JavaScript/TypeScript, Go, Ruby, or similar.
• Experience with static analysis tooling and custom rule authoring.
• Hands-on with threat modeling, authentication/authorization design, cloud security, or supply chain security.

Responsibilities

• Surface real risk using agentic security systems, static analysis, manual review, and threat modeling.
• Validate findings; extend automated tooling to reduce manual effort.
• Develop static analysis rules to block vulnerabilities at PR time.
• Contribute to intake pipeline to graduate findings into merge‑blocking rules.
• Provide security consulting on architectural questions across products.

Skills

5+ years in security engineering

2+ years in vulnerability discovery

code reading across ecosystems

static analysis tooling

threat modeling

communication skills

Education

A related technical degree

Tools

Semgrep

CodeQL

Job description

Salesforce is seeking an experienced security engineer to join the agentforce security team. You will work with product engineering to surface, validate, and prevent vulnerabilities across a large software portfolio, using agentic scanners, static analysis, and manual review.

You will evaluate findings, write static analysis rules, and contribute to the intake pipeline. This role requires deep language experience and the ability to scope work in ambiguity while communicating clearly.