About Salesforce
Salesforce is the #1 AI CRM, where humans with agents drive customer success together.
Job Title: Senior Product Security Engineer
The Experience
•Salesforce's Platform Security team protects the platform that our customers, partners, and developers build on. We are hands-on security engineers who work closely with Product and Engineering throughout the software development lifecycle.
•As a Senior Product Security Engineer, you secure the platform's integration and service-connectivity layer. This includes events, messaging, connectors, Application Programming Interfaces (APIs), and the agent and Model Context Protocol (MCP) connectors that let external tools and AI models talk to the platform.
•You help a fast-moving Engineering organization ship safely. You do this through threat modeling, design and code reviews, and secure-by-default guidance. You also get to shape how AI agents connect securely to the world's #1 AI CRM.
•This role is based in San Francisco, CA, or Seattle/Bellevue, WA and is eligible for a hybrid work arrangement.
What You'll Actually Be Doing
•Lead threat modeling and security design reviews for the platform's event, messaging, and integration pathways, connectors, and APIs that move customer data between systems. Trace issues to their root cause so fixes land in the right place.
•Secure service-to-service authentication, external client apps, and agent and MCP connectors, where excessive privilege, secret leakage, and misuse of delegated access are key threats.
•Build secure-by-default patterns into frameworks, connector software development kits (SDKs), and onboarding paths. Review Java, JavaScript, and TypeScript code in a large codebase to validate design assumptions and find risk in authentication, integration, and access-control flows.
•Partner with architects, engineers, and product owners to move findings to resolution, and mentor junior security engineers on secure design and threat modeling.
You're Our Person If...
•You have 5+ years of experience in product, application, or platform security.
•You have hands-on experience securing backend, integration, or service-connectivity systems, including API security (REST and GraphQL authentication, rate limiting, and input validation).
•You have working experience with OAuth 2.0, OpenID Connect (OIDC), and JSON Web Tokens (JWT), plus service-to-service authentication and permission models.
•You have reviewed source code in Java and at least one other language (JavaScript, TypeScript, Python, or Go) to confirm security risk.
Even Better If...
•You have secured eventing, messaging, integration, or API platforms at scale.
•You have connector security, agent integration, or MCP experience, including how trust boundaries work in agentic systems beyond basic prompt injection.
•You have multi-tenant software as a service (SaaS) backend security experience at the application layer.
•You have served as the embedded security subject-matter expert (SME) for a product area.
•You can independently own threat models and explain distributed-systems risks such as race conditions and concurrency flaws.
•You write clear security guidance and lead design reviews that keep teams moving.
Compensation
The typical base salary range for this position is $148,500 - $223,900 annually. In select cities within the San Francisco and New York City metropolitan area, the base salary range for this role is $178,900 - $246,000 annually. The range represents base salary only, and does not include company bonus, incentive for sales roles, equity or benefits, as applicable.
