Senior Red Team Engineer - Product Security & Attacks

Salesforce; Bellevue (WA); On-site; USD 149,000 - 224,000; Full time

Job summary

Salesforce in the United States is seeking a Senior Offensive Security Engineer, Red Team to design and run adversary simulations against product trust boundaries, uncovering high-impact attack chains across a SaaS portfolio.

You will own engagements end to end, collaborate with Detection Engineering and Incident Response teams, and apply AI-driven testing alongside traditional methods to improve security across web apps, APIs, and multi-tenant surfaces.

Qualifications

• Hands-on offensive security experience focusing on web application and API attack surfaces.
• Strong command of web app and API exploitation (auth bypasses, SSRF, IDOR, OAuth/SAML/OIDC attacks).
• Experience with multi-tenant isolation failures and identity federation.
• Ability to read production code at scale in Java, Python, Go, JavaScript, TypeScript, or Apex and know cloud security fundamentals.

Responsibilities

• Build and demonstrate multi-step attack chains across the product ecosystem, including web apps, APIs, and cross-tenant boundaries.
• Own engagements end to end: charter development, threat modeling, backlog management, and technical reporting with root causes and remediation guidance.
• Collaborate with Detection Engineering, Detection and Response, and Incident Response teams to validate alerts and close visibility gaps.
• Apply AI-driven testing techniques alongside traditional manual methods, dedicating time to research novel attack techniques and tooling.

Skills

Web app security

API security

Red team operations

Cloud security

Tools

MuleSoft

Job description

Salesforce in the United States is seeking a Senior Offensive Security Engineer, Red Team to design and run adversary simulations against product trust boundaries, uncovering high-impact attack chains across a SaaS portfolio.

You will own engagements end to end, collaborate with Detection Engineering and Incident Response teams, and apply AI-driven testing alongside traditional methods to improve security across web apps, APIs, and multi-tenant surfaces.