Senior/Lead/Principal Application Security Researcher

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts. Job Category Product Job Details About Salesforce Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all. Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce. About This Role We're building something special in our Israel-based Offensive Security organization, and we're hiring multiple people across three key areas: Penetration Testing Red Team Product Security Research While these roles share a common foundation in offensive security tradecraft, each brings its own unique focus and impact. We're looking for deep expertise in at least one of these areas, with the ability to grow across others. We have multiple openings and are looking for talent at various levels. As we get to know you through the interview process, we'll work together to identify the best fit matching your expertise and interests with the specific role and level (Senior, Lead, or Principal) that makes the most sense for both you and the team. Role Overview We are seeking a highly skilled offensive security professional to join our elite team. This role is ideal for someone who thrives on breaking systems, finding creative attack paths, and using their findings to drive meaningful security improvements across Salesforce's products and infrastructure. You will work alongside some of the best minds in security, operating with significant autonomy and impact. Whether you specialize in deep application level penetration testing, red teaming, security research or vulnerability discovery, we want to hear from you—you don't need to be an expert in all three domains. What unites these roles is a relentless attacker mindset, a drive to find and demonstrate real-world impact, and the ability to translate offensive findings into lasting security improvements. Responsibilities Conduct advanced penetration testing, red team operations, or security research targeting Salesforce's cloud infrastructure, applications, and services Discover, exploit, and document security vulnerabilities using creative and methodical approaches Develop custom tools, exploits, and attack techniques to simulate real-world adversaries Collaborate with product teams to remediate vulnerabilities and improve secure design practices Contribute to the maturity of our offensive security program through automation, tooling, and process improvements Mentor and share knowledge with team members, fostering a culture of continuous learning Present findings and security insights to technical and executive audiences Stay ahead of emerging threats, attack techniques, and offensive security tradecraft Required Qualifications 5+ years of hands-on experience in offensive security (Senior), 7+ years (Lead), or 10+ years (Principal). Deep, demonstrable expertise in at least one of the following domains: penetration testing, red teaming, application security research, or vulnerability discovery, with strong foundational knowledge and willingness to learn across other offensive security disciplines. Proven ability to identify and exploit complex vulnerabilities in web applications, APIs, cloud environments, or infrastructure. Strong programming/scripting skills (e.g., Python, Go, Bash, PowerShell) for tooling and automation. Deep understanding of attack frameworks (MITRE ATT&CK), common vulnerability classes (OWASP, CWE), and exploitation techniques. Excellent written and verbal ... (truncated, view full listing at source)