Description

As a Product Security Associate, you will play a vital role in ensuring the integrity and security of our software and Build ecosystem. This role is designed for a technically proficient engineer who is passionate about building security into the foundations of the Software Development Lifecycle rather than treating it as an afterthought. You will work across modern build systems, cloud environments, AI coding tools and infrastructure and the security around them, to protect company data and assets.

Key Responsibilities:

• Secure SDLC Integration: Collaborate with engineering teams to integrate security checkpoints into the Software Development Life Cycle (SDLC) without slowing down the pace of innovation.

• Pipeline & Build Security: Harden CI/CD pipelines (e.g., Jenkins, GitHub Actions) to prevent unauthorized code injection and ensure the integrity of build artifacts.

• Software Supply Chain Defense: Monitor and secure the software supply chain by verifying third-party dependencies, managing Software Bill of Materials (SBOMs), and implementing provenance checks.

• Cloud Infrastructure Security: Assist in securing cloud-native environments (AWS/GCP/Azure), focusing on resource configuration and secure deployment patterns.

• AI Security & Governance: Evaluate and secure the use of AI coding assistants and LLM-integrated development tools, ensuring they adhere to secure coding standards and do not introduce risks of data leakage.

• Automation & Tooling: Write scripts and basic applications to automate repetitive security tasks and integrate security tooling directly into developer workflows.

Technical Skills & Qualifications:

• Linux/Unix Systems: Foundational knowledge of Linux environments, including command-line proficiency, file system security, and process management.

• Programming & Scripting: Ability to read and write code in at least one major language (e.g., Python, Go, JavaScript…). You should be comfortable performing basic code reviews for security logic.

• Build Systems: Understanding of how code moves from a developer’s machine to production, including experience with containerization (Docker/Kubernetes).

• Networking Fundamentals: Understanding of core networking concepts such as TCP/IP, DNS, TLS/SSL, and how they apply to securing distributed software systems.

• Cloud Foundations: Familiarity with at least one major cloud provider and an understanding of “Infrastructure as Code” (Terraform or CloudFormation).

Required Skills:

• Strong background in Computer Science or a related engineering discipline

• Must be located in North America

• Academic, professional or internship experience working in a professional engineering or cybersecurity environment

• Fluency in software coding and code reviews

Desired Skills:

• Knowledge of application and cloud security

• Knowledge of securing AI systems

• Knowledge with CI/CD pipelines

• Knowledge of Linux

For roles in San Francisco and Los Angeles: Pursuant to the San Francisco Fair Chance Ordinance and the Los Angeles Fair Chance Initiative for Hiring, Salesforce will consider for employment qualified applicants with arrest and conviction records.