Product Security Lead

What you'll do

• Lead threat modeling, security design reviews, and targeted code reviews across web/UI frameworks, runtimes, rendering pipelines, and guest-user data-access APIs.
• Serve as security lead for cross-team, multi-release programs and establish security standards and secure patterns for web/UI, data access, and rendering.
• Mitigate AI and agentic risks, including prompt injection and excessive agency, and define safeguards such as human-in-the-loop gates, least-privilege access, audit logging, and short-lived credentials.

What they ask for

• Deep expertise in web/application security and modern UI frameworks, web runtimes, or data-access APIs; hands-on experience addressing web weaknesses and securing guest-user or unauthenticated surfaces.
• Threat-modeling experience across complex web, UI, or data-access environments, driven to resolution.
• Ability to reason about AI/LLM or agentic security risks in real product work.
• Track record authoring security standards and leading cross-team, multi-release programs; fluent JavaScript/TypeScript review and at least one of Java, Python, or Go.

Nice to have

• Experience securing UI frameworks, web runtimes, GraphQL/data-access APIs, or rendering frameworks at scale, ideally in large-scale multi-tenant SaaS.
• Hands-on LLM application security, agent frameworks, or MCP experience; security program ownership or bug bounty/red-team experience.

Pay

$172,500 - $260,100 annually (base salary); $207,800 - $285,800 annually (base salary)

Tools

JavaScript/TypeScript, Java, Python, Go, GraphQL, Model Context Protocol (MCP)

AI focus

Own security for AI agent-driven experiences, addressing prompt injection, excessive agency, context/memory poisoning, tool/agent abuse, and MCP/connector risks; design human-in-the-loop gates and access controls. Salesforce also uses AI tools to help recruiters assess resumes and qualifications, with humans making selection and hiring decisions.