Product Security Lead

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts. Job Category Product Job Details About Salesforce Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all. Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce. The Experience You will be the embedded security authority for Salesforce Clouds including e-commerce and marketing area. You will work with engineering, architecture and BISO partners to make the products secure by design and resilient against real-world attacks on AI, APIs and the tenant environment. What You'll Actually Be Doing • Lead security architecture and design reviews, code reviews and threat modeling for Cloud features and services. • Drive remediation of vulnerabilities from pen tests, bug bounty and ASA findings. Own SLAs and risk acceptance. • Design and drive controls against Authentication and authorization weaknesses , storefront abuse, credential stuffing, bot traffic and API abuse. • Partner with Detection & Response on the security with product context • Advise on multi-tenant isolation, authentication and authorization, secrets and key management, and PCI-relevant payment flows. • Act as the escalation point of contact for security incidents and customer security questions as product security advisory. Brief leadership on risk posture. Suggest short term, long term remediation plans. • Influence Security roadmaps across Commerce and Trust. You will remain close to the code and architecture while multiplying the effectiveness of other security and engineering teams. • Mentor engineers and security champions, and improve secure SDLC practices. You're Our Person If... • 7+ years in application, product or cloud security, with deep knowledge of web and API security (OWASP, OAuth/OIDC, SSO). • Experience securing e-commerce and SaaS platforms, including payments , headless/storefront architectures. • Experience reviewing multi-tenant SaaS platforms and enforcing tenant, or organizational data isolation. • Familiarity with secure software-supply-chain practices, dependency analysis, artifact provenance, build systems, and vulnerability-management workflows. • Strong threat modeling and secure code review skills. Fluent in Java/JavaScript/Node ecosystems. • Experience securing Public-cloud infrastructure (AWS/Hyperforce, Kubernetes, GCP) and familiarity with logging and detection pipelines. • Experience securing AI-enabled product features, including prompt and tool boundaries, data access, agent authorization, and indirect prompt-injection risks. • Ability to influence senior engineers and leaders without direct authority, and communicate risk clearly. • A history of responsible vulnerability research, security tooling development Even Better If... • Familiarity with Commerce platforms, bot mitigation, or fraud and abuse prevention. • Relevant certifications (CISSP, GIAC, OSCP etc). • Experience running or triaging bug bounty programs. • Conference presentations, Publications, or Contributions to the Security Community. Unleash Your Potential When you join Salesforce, you’ll be limitless in all areas of your life. Our benefits and resources support you to find balance and   be your best , a