Senior Product Security Engineer — AI-Driven Trust

Salesforce, Inc.; Northern (KY); Hybrid; USD 149,000 - 224,000; Full time

Benefits offered by this job

Time off programs

Medical

Dental

Vision

Mental health support

Paid parental leave

Life and disability insurance

401(k)

Employee stock purchasing program

Job summary

Salesforce, Inc. is seeking a senior security engineer to surface real risk using agentic security systems, static analysis, and threat modeling.

You will extend tooling to minimize manual validation while delivering measurable detections and secure architecture decisions across products. The role requires hands-on vulnerability discovery, deep language ecosystem knowledge, and the ability to author and tune custom rules in Semgrep or CodeQL.

Qualifications

• 5+ years in security engineering, application security, or a directly adjacent role.
• At least 2 of those years in a hands-on vulnerability-discovery capacity.
• Deep familiarity with at least one major language ecosystem (e.g., Java, Python, JavaScript/TypeScript, Go, Ruby).
• Working knowledge of static analysis tooling and how custom rules are authored, tuned, and maintained (Semgrep, CodeQL, or equivalent).
• Experience with threat modeling, authentication/authorization design, cloud security architecture, or supply chain security.

Responsibilities

• Use agentic security systems, static analysis, manual review, and threat modeling to surface real risk.
• Extend automated tooling to reduce manual validation time.
• Create static analysis rules to block common classes of vulnerabilities at PR-time.
• Contribute to the intake pipeline to elevate high-value findings into merge-blocking rules.
• Provide security consulting on hard architectural questions.
• Scope work in ambiguous environments and communicate clearly.

Skills

Security engineering

Application security

Vulnerability discovery

Static analysis tooling

Threat modeling

Cloud security

RBAC/ABAC

Communication skills

Open-source security

Education

Bachelor's degree in a related field

Tools

Semgrep

CodeQL

Job description

Salesforce, Inc. is seeking a senior security engineer to surface real risk using agentic security systems, static analysis, and threat modeling.

You will extend tooling to minimize manual validation while delivering measurable detections and secure architecture decisions across products. The role requires hands-on vulnerability discovery, deep language ecosystem knowledge, and the ability to author and tune custom rules in Semgrep or CodeQL.