Enterprise Application Engineer (Enterprise Security. Security AI)

Join Salesforce's Secure AI team as an Enterprise Application Security Engineer. In this role, you will assess and maintain the security of AI tooling, conduct in-depth security assessments of emerging AI technologies, and collaborate with engineering teams and business partners to drive solutions through a secure development lifecycle. You will also research new technologies, emerging threats, and vulnerabilities to support strategic planning and process improvements.

• Collaborate with business stakeholders and technology partners to assess and maintain the security of AI tooling, ensuring compliance with Salesforce security requirements.
• Conduct in-depth security assessments of emerging AI technologies, including architecture and design reviews, code reviews, and penetration tests.
• Research new technologies, emerging threats, and vulnerabilities to support strategic planning and process improvements, and build tools to enable secure use of AI at scale.

• Experience with large language models (LLMs) and agentic systems — building, evaluating, or securing them
• 8+ years of experience in a security engineering role including Application Security and Pen testing experience (Lead/LMTS)
• Understanding of RAG architectures, classifier models, and how retrieval and generation pipelines work
• A related technical degree required
• Develop automated processes and support improvement of tooling to identify and solve problems at scale
• Experience with AI security attack surfaces including prompt injection, data exfiltration, privilege escalation in agents, and model supply chain risks
• Excellent interpersonal, collaboration, and critical-thinking skills
• 5+ years of experience in a security engineering role including Application Security and Pen testing experience (Senior/SMTS)
• Familiarity with standard security frameworks such as ISO 27001, SOC 2, PCI DSS, OWASP Top 10, CWE Top 25, and MITRE ATT&CK
• Relevant BA/BS degree and/or certifications such as CRISC, CISSP, CCIE, CISM, CISA, or CCSK
• Experience defining and communicating security remediation tasks to project and data owners