# Senior Security Engineer

**Company**: Salesforce
**Location**: San Francisco, California
**Experience**: senior
**Job type**: full-time
**Salary**: $148,500 - $223,900 annually
**Category**: Security
**Industry**: Technology

**Apply**: https://salesforce.wd12.myworkdayjobs.com/en-US/External_Career_Site/job/California---San-Francisco/Senior-Production-Support-Engineer_JR368302?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/job/senior-security-engineer-561bfd80-bbe/

## Description

MuleSoft Security Engineering protects the Anypoint Platform and the infrastructure it runs on. As a Senior Security Engineer focused on infrastructure, you will design, build, and operate identity, network, and cloud security controls in AWS.

**Core Responsibilities & Scope**

- Implement and maintain security controls that satisfy FedRAMP requirements, mapped to NIST SP 800-53.

- Engineer secure network architecture in AWS: VPC design, segmentation, security groups, NACLs, Transit Gateway, PrivateLink, WAF, and egress controls.

- Design and improve identity and access management: IdP integration, SSO, federation (SAML, OIDC, OAuth), IAM roles and policies, least privilege, privileged access, secrets management, and KMS key management.

- Build and maintain infrastructure as code in Terraform, including reusable modules, secure defaults, policy-as-code, and automated guardrails.

- Harden and secure Linux systems and containers, including host baselines, runtime security, and Kubernetes workloads.

- Support continuous monitoring: vulnerability remediation within required timelines, POA&M tracking, and evidence collection for audits.

- Automate control validation and evidence gathering.

- Partner with Engineering, SRE, and Compliance to embed security into the SDLC and deployment pipelines.

- Contribute to incident response and detection engineering, including logging, SIEM integration, and alerting.

- Produce clear technical documentation and architecture reviews, and mentor other engineers.

**Minimum Requirements**

- 5+ years in security engineering, cloud security, or infrastructure security.

- Experience implementing and meeting security controls in a FedRAMP environment, or an equivalent framework (for example, NIST 800-53, NIST 800-171, or CMMC).

- Solid knowledge of NIST security controls, including control families, baselines, and how to map them to technical implementations.

- Strong, hands-on Terraform skills, including module design, state management, and CI/CD-driven deployments.

- Deep experience with network security engineering in AWS (VPC, Transit Gateway, security groups, WAF, GuardDuty, Security Hub, Config, CloudTrail).

- Hands-on identity engineering: IdPs, SAML, OIDC, OAuth 2.0, and directory and authentication protocols (LDAP, Kerberos), plus AWS IAM and KMS.

- Strong understanding of TLS and PKI, including certificate lifecycle management and secure protocol configuration.

- Strong Linux systems and container experience.

- Proficiency in a scripting language (Python, Go, or Bash).

- Strong written and verbal communication, including working with auditors and engineering teams.

- U.S. citizenship and the ability to work from the U.S., as required by federal regulation for access to the FedRAMP environment.

**Preferred Qualifications**

- Practical experience using AI tools to accelerate engineering work, with sound judgment in reviewing AI-generated code and configurations for security.

- Experience supporting a FedRAMP authorization, annual assessment, or 3PAO assessment.

- Experience with Kubernetes security at scale.

- Working knowledge of vulnerability management, patching, and remediation workflows.

- Familiarity with FIPS 140-2/140-3 validated cryptography.

- Experience with AWS GovCloud.

- Experience with FedRAMP 20x, continuous monitoring automation, OSCAL and/or similar frameworks and technologies.

- Familiarity with CISA directives and DISA STIGs.

- Experience with policy-as-code (OPA, Sentinel, Checkov) and software supply chain security.

- Certifications such as AWS Security Specialty, CKS, CCSP or similar is preferred.

**What Success Looks Like**

- First 90 days: You understand the infrastructure architecture and control inventory, and you own remediation of a defined set of control gaps.

- 6 months: You deliver network and identity security improvements through Terraform and automate at least one control validation workflow.

- 12 months: You are a recognized technical authority for AWS infrastructure security and compliance, and you help keep the team audit-ready.

For more fresh new jobs, check out [yubhub.co](https://yubhub.co/).

## Skills

### Required
- Terraform
- AWS
- NIST SP 800-53
- FedRAMP
- Linux
- Kubernetes
- Python
- Go
- Bash
- SAML
- OIDC
- OAuth
- LDAP
- Kerberos
- TLS
- PKI

### Nice to have
- AI tools
- Kubernetes security
- FIPS 140-2/140-3
- AWS GovCloud
- OSCAL
- policy-as-code
- software supply chain security
- AWS Security Specialty
- CKS
- CCSP

---

Source: [Apply at salesforce.wd12.myworkdayjobs.com](https://salesforce.wd12.myworkdayjobs.com/en-US/External_Career_Site/job/California---San-Francisco/Senior-Production-Support-Engineer_JR368302?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)