Platform Security Architect

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts. Job Category Customer Success Job Details About Salesforce Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all. Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce. The Opportunity: The Platform Guardian We are seeking a Salesforce Platform Expert who specializes in security implementation. You are not just a compliance officer; you are a builder. You understand the Salesforce metadata API better than anyone, you know the limits of Apex Managed Sharing, and you know exactly which "Session Settings" break the user experience if configured incorrectly. In this role, you will be the bridge between our security requirements and the technical reality of the Salesforce platform. You will use your deep platform expertise to architect, configure, and implement the controls that keep our ecosystem secure without sacrificing performance or agility. Role Summary The Salesforce Platform Security Architect is responsible for the hands-on design and implementation of security controls within the Salesforce org. You will own the technical configuration of Sharing & Visibility, Shield Encryption, and Identity flows. You will work alongside developers and admins to ensure that every Flow, Apex Class, and Integration is built securely from the ground up. You translate abstract security policies (e.g., "Least Privilege") into concrete Salesforce configurations (e.g., "Permission Set Groups" and "Field Level Security"). Key Responsibilities Platform Security Implementation (The "Hands-On" Work) Sharing Architecture: Design and implement complex sharing models. Optimize Org-Wide Defaults (OWD), Sharing Rules, Account Teams, and Territory Management to ensure strict data segregation. Shield Implementation: Lead the technical deployment of Salesforce Shield. Manage Tenant Secrets, define encryption policies for standard/custom fields, and configure Field Audit Trails to meet retention policies. Identity Configuration: Configure and troubleshoot SSO (SAML/OIDC), Connected Apps, and Login Flows. managing certificates and Key Management (BYOK) where applicable. Event Monitoring & Detection Real-Time Monitoring: Build Transaction Security Policies (using Apex or Low-Code) to block data exfiltration attempts in real-time. Log Analysis: Configure Event Monitoring to export logs to our SIEM (Splunk/New Relic). Create dashboards to visualize login anomalies and report exports. Secure Development Lifecycle (SDLC) Code Security: Act as the "Security Gatekeeper" for deployments. Review Apex and LWC code for common vulnerabilities (SOQL Injection, XSS, Enforcing Sharing). DevOps Integration: Configure static code analysis tools (e.g., PMD, Checkmarx, Clayton) within our CI/CD pipeline (Copado/Gearset/Jenkins) to auto-reject insecure code. Connected App & OAuth Governance (Critical Focus) OAuth Flow Architecture: Select and implement the correct OAuth flows for specific use cases (e.g., JWT Bearer Flow for server-to-server integration vs. Web Server Flow for user-facing apps vs. Device Flow for IoT). Scope Management: Enforce the principle of Least Privilege by meticulously defining and auditing OAuth Scopes (e.g., ensuring an integration only has api access and not full access). Session Policies: Configure granular session policies per Connected App, enforcing High Assurance sessions (MFA) for sensitive apps and defining strict timeout values. Client Secret Management: Manage the lifecycle of Consumer Keys and Secrets, including rotation strategies and ensuring secrets are never hardcoded in external systems. IP Relaxation: configure "Enforce IP Restrictions" vs. "Relax IP Restrictions" settings on a per-app basis to balance security with accessibility. Security Center & Multi-Org Governance Centralized Policy Management: Implement and manage Salesforce Security Center to define and push baseline security policies (e.g., Password Policies, Session Settings, Trusted IP Ranges) from a central tenant to all child orgs. Drift Detection: Configure Security Center to monitor for Configuration Drift. Create alerts that trigger immediately if a local admin in a child org attempts to weaken security settings (e.g., disabling MFA or relaxing IP restrictions). Health Visibility: Maintain a single-pane-of-glass view of security health scores across the entire multi-org landscape, reporting on KPI improvements to leadership. Technical Advisory Platform Limits: Advise the business on the performance impacts of security decisions (e.g., "How will encrypting this field impact SOQL query performance?"). Release Readiness: Review the Salesforce Release Notes (3x/year) specifically for security updates (e.g., MFA enforcement, Browser policy changes) and proactively prepare the org. Qualifications Required Salesforce Expertise (The "Must Haves"): 10+ Years of hands-on experience in the Salesforce ecosystem as a Technical Architect, Developer, or Senior Administrator. Sharing & Visibility Master: You can explain "Implicit Sharing," "Group Maintenance Tables," and "Apex Managed Sharing" in your sleep. Apex & Metadata Fluency: You can read Apex triggers and understand how to query the LoginHistory or SetupAuditTrail objects via SOQL. Implementation Experience: Proven track record of actually turning on and configuring Platform Encryption, Event Monitoring, or multi-factor authentication in a large, complex org. Security Fundamentals: Understanding of basic security concepts: Least Privilege, Separation of Duties, Encryption (At Rest vs. In Transit), and CIA Triad. Familiarity with common web vulnerabilities (OWASP Top 10) specifically in the context of Salesforce (e.g., "How to prevent XSS in Visualforce/LWC"). Certifications: Required: Salesforce Certified System Architect (or progress towards it). Required: Salesforce Certified Sharing and Visibility Architect. Required: Salesforce Certified Identity and Access Management Architect. Bonus: Salesforce Certified Technical Architect (CTA). Why This Role? Technical Depth: You won't be writing policies in Word documents all day. You will be in the Setup menu, in the IDE, and in the metadata, building tangible security solutions. High Impact: You will control the keys to the kingdom, securing the data of millions of customers on one of the world's largest SaaS platforms. Unleash Your Potential When you join Salesforce, you’ll be limitless in all areas of your life. Our benefits and resources support you to find balance and be your best, and our AI agents accelerate your impact so you can do your best. Together, we’ll bring the power of Agentforce to organizations of all sizes and deliver amazing experiences that customers love. Apply today to not only shape the future — but to redefine what’s possible — for yourself, for AI, and the world. Accommodations If you need a reasonable accommodation during the application or the recruiting process, please submit a request via this Accommodations Request Form. Please note that Salesforce uses artificial intelligence (AI) tools to help our recruiters assess and evaluate candidates’ resumes and qualifications throughout the recruiting process. Humans will always make any candidate selection and hiring decisions. Please see our Candidate Privacy Statement for more information about how we use your personal data and your rights, including with regard to use of AI tools and opt out options. Posting Statement Salesforce is an equal opportunity employer and maintains a policy of non-discrimination with all employees and applicants for employment. What does that mean exactly? It means that at Salesforce, we believe in equality for all. And we believe we can lead the path to equality in part by creating a workplace that’s inclusive, and free from discrimination. Know your rights: workplace discrimination is illegal. Any employee or potential employee will be assessed on the basis of merit, competence and qualifications – without regard to race, religion, color, national origin, sex, sexual orientation, gender expression or identity, transgender status, age, disability, veteran or marital status, political viewpoint, or other classifications protected by law. This policy applies to current and prospective employees, no matter where they are in their Salesforce employment journey. It also applies to recruiting, hiring, job assignment, compensation, promotion, benefits, training, assessment of job performance, discipline, termination, and everything in between. Recruiting, hiring, and promotion decisions at Salesforce are fair and based on merit. The same goes for compensation, benefits, promotions, transfers, reduction in workforce, recall, training, and education. In the United States, compensation offered will be determined by factors such as location, job level, job-related knowledge, skills, and experience. Certain roles may be eligible for incentive compensation, equity, and benefits. Salesforce offers a variety of benefits to help you live well including: time off programs, medical, dental, vision, mental health support, paid parental leave, life and disability insurance, 401(k), and an employee stock purchasing program. More details about company benefits can be found at the following link: to the San Francisco Fair Chance Ordinance and the Los Angeles Fair Chance Initiative for Hiring, Salesforce will consider for employment qualified applicants with arrest and conviction records.