Senior Product Security Engineer — Scale & Threat Modeling

Salesforce; San Francisco (CA); On-site; USD 179,000 - 246,000; Full time

Benefits offered by this job

Health insurance

Time off programs

Employee stock purchase plan

Job summary

Salesforce is seeking a Senior Security Engineer to join Product Security and partner with product engineering teams to find, validate, and prevent vulnerabilities across a large enterprise software portfolio. You will work with agentic scanners, static analysis, and dynamic validation to guide remediation decisions.

You will leverage your experience in Java, Python, JavaScript/TypeScript, Go, or Ruby, and apply threat modeling and cloud security principles to secure the codebase and supply

Qualifications

• 5+ years in security engineering or related role.
• 2+ years hands-on vulnerability-discovery capacity.
• Familiarity with at least one major language ecosystem (Java, Python, JavaScript/TypeScript, Go, Ruby).
• Working knowledge of static analysis tooling and how custom rules are authored (Semgrep, CodeQL).
• Experience with threat modeling, authentication/authorization design, cloud security, or supply chain security.

Responsibilities

• Surface real risk using agentic security systems, static analysis, manual review, and threat modeling.
• Validate findings; reduce manual validation cost.
• Create static analysis rules to block recurring vulnerabilities at PR time.
• Contribute to intake pipelines for high-value findings and policy decisions.
• Provide security consulting on architectural questions.
• Apply scoping methodology across products you work on.
• Measure impact: detections shipped, vulnerabilities closed, systemic patterns eliminated.

Skills

Security engineering

Application security

Code literacy

Static analysis tools

Threat modeling

Cloud security

Authorization design

Education

Technical degree

Tools

Semgrep

CodeQL

Job description

Salesforce is seeking a Senior Security Engineer to join Product Security and partner with product engineering teams to find, validate, and prevent vulnerabilities across a large enterprise software portfolio. You will work with agentic scanners, static analysis, and dynamic validation to guide remediation decisions.

You will leverage your experience in Java, Python, JavaScript/TypeScript, Go, or Ruby, and apply threat modeling and cloud security principles to secure the codebase and supply