Senior Product Security Engineer – Platform & API Integrations

Salesforce, Inc.; San Francisco (CA); On-site; USD 149,000 - 224,000; Full time

Job summary

Salesforce, Inc. is seeking a Senior Product Security Engineer for the Platform security team, focusing on the platform's integration and service-connectivity layer, including events, messaging, connectors, APIs, and data flows across trust boundaries.

You will surface concrete security risk, drive mitigations, and guide secure-by-default practices across a fast-moving engineering organization. You will review code (Java, JavaScript/TypeScript, or other languages) to validate design assumptions,

Qualifications

• 5+ years in product, application, or platform security operating independently on problems of moderate-to-high complexity.
• Advanced knowledge of authorization and complex permission/scope models with service-to-service authentication.
• Familiarity with delegated authorization flows such as OAuth 2.0, OpenID Connect (OIDC), and JSON Web Tokens (JWT).
• Ability to review and analyze Java source code and at least one other language (JavaScript/TypeScript, Python, or Go).

Responsibilities

• Own security assurance for backend and integration areas, driving threat modeling and security design reviews.
• Secure service-to-service and connector trust boundaries, authentication, and secret handling.
• Review code in Java and other languages to validate design assumptions and identify root causes.
• Collaborate with architects, engineers, and product owners to push secure-by-default patterns and coach junior security engineers.

Skills

API security

Threat modeling

Secure code review

Security design reviews

Security engineering

Tools

Java

JavaScript/TypeScript

Python

Go

Job description

Salesforce, Inc. is seeking a Senior Product Security Engineer for the Platform security team, focusing on the platform's integration and service-connectivity layer, including events, messaging, connectors, APIs, and data flows across trust boundaries.

You will surface concrete security risk, drive mitigations, and guide secure-by-default practices across a fast-moving engineering organization. You will review code (Java, JavaScript/TypeScript, or other languages) to validate design assumptions,