Senior Product Security Engineer - Scale Trust & Security

Salesforce; Washington; On-site; USD 150,000 - 210,000; Full time

Job summary

Salesforce is seeking a senior security engineer to help secure a large enterprise software portfolio. You will work with product engineering teams to surface, validate, and prevent security vulnerabilities across code, APIs, and cloud services.

You will craft static analysis rules, extend agentic tooling, and influence risk decisions at the pull-request stage. Collaboration with leadership and product teams is essential.

Qualifications

• 5+ years in security engineering, application security, or adjacent role.
• Deep familiarity with at least one major language ecosystem and ability to read code in others.
• Experience with static analysis tooling and custom rule authoring.
• Experience with threat modeling, auth design, cloud security, or supply chain security.
• Comfort operating in ambiguity and scope-owning ability.
• Excellent written and verbal communication.
• A related technical degree is required.

Responsibilities

• Use agentic security systems, static analysis, manual review, and threat modeling to surface real risk.
• Spend time on validation, sometimes manually, sometimes by extending tooling.
• Develop static analysis rules to block classes at pull-request time.
• Contribute to intake pipelines for high-value findings.
• Provide security consulting on architectural questions.
• Apply scoping methodology across products you work on.
• Measure impact through detections shipped and vulnerabilities closed.

Skills

Security engineering

Vulnerability discovery

Programming languages

Static analysis tooling

Semgrep

CodeQL

Threat modeling

Cloud security

Authentication/authorization design

Ambiguity tolerance

Communication skills

Education

Related technical degree

Tools

Semgrep

CodeQL

Job description

Salesforce is seeking a senior security engineer to help secure a large enterprise software portfolio. You will work with product engineering teams to surface, validate, and prevent security vulnerabilities across code, APIs, and cloud services.

You will craft static analysis rules, extend agentic tooling, and influence risk decisions at the pull-request stage. Collaboration with leadership and product teams is essential.