Product Security Lead

About the role

Salesforce’s Platform Security team protects the foundational platform that customers, partners, and developers build on. As the technical security lead for the user‑facing application and experience layers, you will set the security assurance bar for front‑end frameworks, runtimes, rendering surfaces, and fast‑growing AI agent‑driven experiences. You’ll shape control design, drive secure‑by‑default patterns, and serve as a trusted security voice across multi‑release, cross‑team programs.

Responsibilities

• Lead security assurance for the experience and UI layer, driving threat modeling, security design reviews, and targeted code reviews (JavaScript/TypeScript, Java) across web and UI frameworks, runtimes, rendering pipelines, and guest‑user‑exposed data‑access APIs.
• Serve as the standing security lead for multi‑quarter, multi‑team programs such as expanding guest‑user data access, first‑party experiences rendering into external surfaces, and defining the trust model for agent‑facing products.
• Push secure patterns into frameworks, SDKs, and rendering pipelines so unsafe patterns are hard to introduce, and author security standards for web/UI security, guest‑user data access, and rendering trust boundaries.
• Own AI and agentic risk, mitigating threats like prompt injection, excessive agency, and context/memory poisoning; design human‑in‑the‑loop gates for high‑risk actions; define least‑privilege scoping, audit logging, and short‑lived credentials for agent and connector integrations, including the Model Context Protocol (MCP).

Requirements

• Deep expertise in web/application security and the security of modern UI frameworks, web runtimes, or data‑access APIs, with hands‑on experience finding and eliminating web weakness classes and securing guest‑user or unauthenticated surfaces.
• Threat‑modeling experience across complex web, UI, or data‑access environments, driven to resolution.
• Ability to reason about AI/large language model (LLM) or agentic risk—prompt injection, tool/agent abuse, or MCP/connector security—and apply that reasoning to real product work.
• Track record of authoring security standards and leading cross‑team, multi‑release security programs, with the ability to influence experienced developers.
• Fluent code review skills in JavaScript/TypeScript plus at least one other modern language (Java, Python, or Go).

Preferred qualifications

• Experience securing UI frameworks, web runtimes, GraphQL/data‑access APIs, or rendering frameworks at scale for large‑scale multi‑tenant SaaS.
• Hands‑on work with LLM application security, agent frameworks, or the Model Context Protocol.
• Ownership of a security program or serving as the standing security lead for a product area.
• Bug bounty or red‑team experience.

Benefits

• Time‑off programs
• Medical, dental, and vision coverage
• Mental health support
• Paid parental leave
• Life and disability insurance
• 401(k) retirement plan
• Employee stock purchase program

Compensation

The typical base salary range for this position is $172,500 – $260,100 annually. In select cities within the San Francisco and New York City metropolitan areas, the base salary range is $207,800 – $285,800 annually. This range represents base salary only and does not include bonus, equity, or benefits.