Offensive Security Researcher

About the role

Salesforce is seeking an Offensive Security Researcher with an attacker mindset to discover, analyze, and remediate security vulnerabilities across its products and platforms. You will work closely with engineering teams to improve security posture and embed secure‑by‑default practices.

Key responsibilities

• Conduct offensive security assessments, including manual testing, code review, architectural analysis, and threat modeling across application ecosystems.
• Identify critical, high‑impact, and systemic vulnerabilities as well as isolated issues.
• Perform security research to uncover emerging attack vectors, abuse cases, and bypass techniques relevant to Salesforce applications.
• Partner with software engineers, tech leads, and architects to explain risk, design remediations, and ensure fixes are scalable and maintainable.
• Execute Secure by Default initiatives by applying security guardrails, remediating insecure defaults, and updating platform‑level controls.

Required profile

• 3+ years of experience in Application Security or Offensive Security with an attacker mindset.
• Proven ability to find and remediate vulnerabilities in complex applications.
• Strong communication and collaboration skills with engineering teams.

Required skills

• Web application security (OWASP Top 10 and beyond).
• Authentication & authorization flaws.
• API security.
• Injection attacks, logic flaws, and access‑control bypasses.
• Secure design and threat modeling.
• Hands‑on manual security testing beyond automated tools.
• Familiarity with cloud‑native architectures, microservices, and distributed systems.