Senior Offensive Security Engineer (Red Team)

About the role

Salesforce’s Product Red Team attacks the full deployed product ecosystem and surrounding infrastructure, not the corporate environment. As a Senior Offensive Security Engineer you will work closely with the Red Team Director to design and run adversary simulations against product trust boundaries, uncover high‑impact attack chains, and translate red‑team operations into engineering and detection improvements across a large, interconnected SaaS product portfolio.

Responsibilities

• Build and demonstrate multi‑step attack chains across the product ecosystem, spanning web‑application and API abuse, identity and authorization failures, cross‑tenant isolation breaks, and integration‑plane trust‑boundary abuse (AppExchange packages, partner APIs, OAuth applications, MuleSoft connectors).
• Own engagements end‑to‑end: charter development, threat modeling, ranked hypothesis backlogs, and technical reporting with root‑cause analysis, variant analysis, and systemic remediation guidance.
• Collaborate with Detection Engineering, Detection and Response, and Incident Response teams to validate alerting and visibility on emulated chains, lead readout sessions, and run purple‑team operations that close visibility gaps.
• Apply AI‑driven testing techniques—agentic tooling, automated reconnaissance, AI‑assisted chain development—alongside traditional manual tradecraft; dedicate roughly 10‑20 % of time to research novel attack techniques and tooling.

Requirements

• Deep, hands‑on offensive security experience with a demonstrated focus on web‑application and API attack surfaces, including a history of finding multi‑step chains (product or SaaS red‑team work, SaaS bug‑bounty Hall of Fame recognition, public CVEs; single‑bug submissions alone do not meet this bar).
• Strong command of web‑application and API exploitation (authentication bypasses, business‑logic abuse, SSRF, injection classes, IDOR, OAuth/SAML/OpenID Connect attacks), multi‑tenant isolation failures, and identity‑federation attacks (SAML, OIDC, OAuth scope confusion, SCIM, JWT manipulation).
• Ability to read production code at scale in at least one language (Java, Python, Go, JavaScript, TypeScript, or Apex) and fluency in cloud security for at least one major provider (IAM abuse, instance metadata, cross‑account pivots, container and orchestration boundaries).
• Familiarity with DevOps and build‑pipeline attack surfaces (CI/CD abuse, dependency confusion, supply‑chain compromise, IaC misconfigurations) and the ability to write clear technical documentation for a VP‑level engineering audience.

Preferred qualifications

• Offensive security certifications such as OSWE, GCPN, eWPTXv2, CWEE, or equivalent.
• Specialization in AI/ML attack surfaces (prompt injection, agentic privilege abuse, RAG pipeline attacks), supply‑chain and build‑pipeline attacks, mobile, or low‑level exploitation.
• Experience against managed‑package ecosystems, SaaS integration platforms, or multi‑tenant SaaS isolation boundaries; familiarity with MITRE ATT&CK, MITRE ATLAS, and the OWASP Top 10.
• Experience operating under formal engagement charters and rules of engagement, with sound judgment about when a chain reaches an authorization boundary and work should stop.

Benefits

• Time‑off programs
• Medical, dental, and vision coverage
• Mental‑health support
• Paid parental leave
• Life and disability insurance
• 401(k) retirement plan
• Employee stock purchase program

Pay

The typical base salary range for this position is $148,500 – $223,900 annually. This range represents base salary only and does not include company bonus, incentive compensation, equity, or benefits.