Software Engineering - MTS, Trust Intelligence Platform

Salesforce•San Francisco, CA

3d•$117,200 - $194,200

About The Position

Salesforce is hiring a Member of Technical Staff to build and operate automation that keeps third-party and open-source dependencies across a large service fleet patched, auditable, and shipped on time. The role owns feature-level work on pipelines that discover vulnerable packages, determine upgrades, open fix pull requests across many repositories, and track fixes through to deployed production artifacts. The position is aimed at engineers with strong pipeline and automation skills who want to develop expertise in software supply chain security. The team will teach domain standards such as CVE, CVSS, SBOM, SLSA, and Sigstore. The engineer will contribute to vulnerability and dependency data pipelines; build and operate batch and streaming jobs; create repository-wide automation and CI/CD workflows; work with service owners to land upgrades; and document designs and operational procedures. The role includes on-call responsibility for owned pipelines, production debugging, regression testing, and end-to-end feature ownership from design through ongoing maintenance.

Requirements

At least 3 years of software engineering industry experience.
Strong proficiency in Python and Java.
Reading fluency in at least two of Node.js, Go, and Ruby.
Hands-on experience contributing to batch or streaming data pipelines, including writing idempotent steps and reasoning about retries.
Direct experience building and maintaining CI/CD pipelines with automated test coverage.
Comfort writing scripts or small services that interact with many repositories, including opening pull requests, parsing diffs, and handling CI feedback.
Experience with a workflow orchestrator such as Airflow, Dagster, Prefect, or Temporal.
Experience with a lakehouse or columnar query engine such as Trino, Presto, Spark, Snowflake, BigQuery, Athena, Databricks, or Iceberg.
SQL skills including non-trivial joins, window functions, and common table expressions.
End-to-end feature-level ownership covering design, implementation, deployment, and follow-up maintenance.
B.S. in Computer Science or Engineering, or equivalent experience.

Nice To Haves

Working familiarity with CVE, CVSS v3, EPSS, CISA KEV, and SBOM formats such as SPDX and CycloneDX.
Direct experience with at least two of Snyk, Trivy, Grype, Dependabot, Renovate, Semgrep SCA, OSV-Scanner, or Dependency-Track.
Exposure to reachability tooling, such as Semgrep, to prioritize fixes by exploitability rather than raw CVE count.
Experience driving changes across many repositories through GitHub Actions, Dependabot configuration, or custom bots.
Working knowledge of layer-based image scanning and base-image lifecycle management.
Working experience with AWS, Kubernetes, Terraform, and container-based deployment.

Responsibilities

Contribute to pipelines that ingest vulnerability data, dependency manifests, SBOM artifacts, and deployment metadata into a queryable analytics store.
Build and maintain batch and streaming jobs with idempotent steps, retries, and clear failure modes.
Operate owned pipelines, participate in on-call, debug production failures, and reduce toil through automation.
Build scripts and small services that operate across many repositories, including opening pull requests, parsing diffs, reading CI feedback, and reconciling results to a central store.
Author and maintain CI/CD pipelines with automated test coverage for remediation pull requests.
Resolve attribution issues at their source rather than patching downstream symptoms.
Partner with service owners to land dependency upgrades, triage breakage, and improve generated fix pull requests.
Translate scanner output into prioritized, actionable work for engineering teams.
Write and maintain clear design documents, runbooks, pull request descriptions, and other documentation as behavior changes.
Write Python and Java code that follows existing codebase conventions and withstands review.
Add regression tests for every bug fixed and use failing tests as useful signals.
Learn supply chain security concepts, including vulnerability lifecycle, dependency resolution, and artifact provenance, and apply that knowledge to pipeline development.
Own features end to end, including design, implementation, deployment, and subsequent maintenance.