Lead / Senior Offensive Security Engineer (Offsec AI Team)

About the role

Salesforce is looking for a Lead or Senior Offensive Security Engineer for its Offensive Security Automation team. The role is hands-on offensive security, focused on performing security assessments and vulnerability research using internal AI tools and frontier models, and on designing and developing the AI automation and autonomous harnesses with the team. It suits someone who can perform offensive security testing at scale.

Key responsibilities

• Perform security assessments and vulnerability research across web applications, APIs and cloud/hybrid infrastructure using internal AI tools and frontier models.
• Make sure the internal solution can perform exploitation, vulnerability chaining, business logic and authorization abuse, privilege escalation and lateral movement.
• Run end-to-end engagements: scoping, execution, reporting and remediation guidance.
• Find systemic and architectural weaknesses and drive secure-by-default fixes.
• Partner with engineering, security architecture and detection and response teams to close root causes and validate controls.
• Produce high-quality technical reports with clear exploitation paths and prioritized remediation.
• Develop automation and autonomous harnesses that direct frontier models to test continuously at scale.
• Design agent-based workflows that plan for risk signals, business logic and multi-step offensive testing, with human-in-the-loop checkpoints.
• Turn your own tradecraft into reusable, explainable automation.

Required profile

• 6+ years (senior) or 8+ years (lead) of hands-on offensive security experience such as pentesting, red teaming or app/security research.
• Deep knowledge of cloud and web application security, including OWASP Top 10 classes, identity and authorization attack vectors and cloud/hybrid attack surfaces.
• Hands-on experience using internal AI tools and frontier models to perform or accelerate security testing.
• Ability to write custom scripts, tooling and payloads and contribute to automation and autonomous harnesses, including prompt engineering.
• Excellent written and verbal communication skills.

Required skills

• OWASP Top 10 vulnerability classes and cloud/web application security
• System design, API integration and distributed services
• Prompt engineering and custom scripting
• Nice to have: agentic frameworks, prompt optimization, agent evaluation, lightweight model fine-tuning, published security research, CVEs or conference talks, and familiarity with MITRE ATT&CK/ATLAS and offensive AI/ML attack surfaces