Penetration Testing Engineer, MTS

Salesforce•San Francisco, CA

23h

About The Position

Salesforce is seeking a Penetration Testing Engineer to conduct hands-on penetration tests across applications, platforms, cloud infrastructure, and AI-powered systems. The role emphasizes real-world exploitation and attack chaining rather than checklist-driven testing, with complex engagements conducted under the guidance of senior team members. The engineer will work with engineering and application security teams to translate findings into practical remediation and develop expertise across cloud, identity, and AI/ML attack surfaces. The position involves testing web applications, APIs, cloud and hybrid infrastructure, identity and trust boundaries, and AI/ML-enabled systems. The engineer will perform manual exploitation, support engagement scoping and execution, assess risk, and produce detailed reports with remediation guidance. They will collaborate with engineering, AppSec, and Detection & Response teams on findings.

Requirements

2–4 years of hands-on experience in penetration testing, offensive security, or application security testing.
Experience performing penetration testing engagements in production or production-like environments using manual techniques and automation or AI tools.
Understanding of application security vulnerabilities and attack chains, identity and access control failures, cloud security fundamentals, and security risks specific to AI and LLM-based systems.
Ability to clearly explain exploitation mechanics, impact, and practical remediation steps to engineers and security teams.

Nice To Haves

Experience creating custom scripts, payloads, or proof-of-concept implementations.
Participation in Bug Bounty programs.
Familiarity with cloud architectures and identity-centric security models.
Experience using AI/LLMs for offensive security work or vulnerability discovery.

Responsibilities

Execute penetration tests across web applications, APIs, cloud and hybrid infrastructure, identity and trust boundaries, and AI/ML-enabled systems.
Test AI systems for issues such as prompt injection and abuse of AI integrations.
Perform manual exploitation beyond automated tooling, including business logic abuse, privilege escalation, and identity or access trust relationship abuse.
Support engagements through scoping, execution, risk assessment, and reporting with remediation guidance.
Produce technically detailed reports describing exploitation paths, missing security controls, and mitigation recommendations.
Collaborate with engineering, AppSec, and Detection & Response teams on findings.