Product Security Lead

The Experience

You will be the embedded security authority for Salesforce Clouds including e-commerce and marketing area. You will work with engineering, architecture and BISO partners to make the products secure by design and resilient against real-world attacks on AI, APIs and the tenant environment.

What You'll Actually Be Doing

• Lead security architecture and design reviews, code reviews and threat modeling for Cloud features and services.
• Drive remediation of vulnerabilities from pen tests, bug bounty and ASA findings. Own SLAs and risk acceptance.
• Design and drive controls against Authentication and authorization weaknesses , storefront abuse, credential stuffing, bot traffic and API abuse.
• Partner with Detection & Response on the security with product context
• Advise on multi-tenant isolation, authentication and authorization, secrets and key management, and PCI-relevant payment flows.
• Act as the escalation point of contact for security incidents and customer security questions as product security advisory. Brief leadership on risk posture. Suggest short term, long term remediation plans.
• Influence Security roadmaps across Commerce and Trust. You will remain close to the code and architecture while multiplying the effectiveness of other security and engineering teams.
• Mentor engineers and security champions, and improve secure SDLC practices.

You're Our Person If...

• 7+ years in application, product or cloud security, with deep knowledge of web and API security (OWASP, OAuth/OIDC, SSO).
• Experience securing e-commerce and SaaS platforms, including payments , headless/storefront architectures.
• Experience reviewing multi-tenant SaaS platforms and enforcing tenant, or organizational data isolation.
• Familiarity with secure software-supply-chain practices, dependency analysis, artifact provenance, build systems, and vulnerability-management workflows.
• Strong threat modeling and secure code review skills. Fluent in Java/JavaScript/Node ecosystems.
• Experience securing Public-cloud infrastructure (AWS/Hyperforce, Kubernetes, GCP) and familiarity with logging and detection pipelines.
• Experience securing AI-enabled product features, including prompt and tool boundaries, data access, agent authorization, and indirect prompt-injection risks.
• Ability to influence senior engineers and leaders without direct authority, and communicate risk clearly.
• A history of responsible vulnerability research, security tooling development

Even Better If...

• Familiarity with Commerce platforms, bot mitigation, or fraud and abuse prevention.
• Relevant certifications (CISSP, GIAC, OSCP etc).
• Experience running or triaging bug bounty programs.
• Conference presentations, Publications, or Contributions to the Security Community.