Software Engineering Architect, PKI & Trust Services

Salesforce•Bellevue, WA

11d

About The Position

Salesforce is hiring a Software Engineering Architect to set the strategy and technical direction for the trust foundation supporting its global, multi-cloud platform. The role focuses on certificate lifecycle management, trust distribution, cryptographic identity for workloads and AI agents, and the evolution of cryptography as certificate lifetimes shorten, lifecycle management becomes fully automated, and post-quantum cryptography advances. It is a hands-on architecture role requiring distributed-systems leadership and strong security judgment. The architect designs for continuous global availability, guides cryptographic evolution without disrupting dependent services, and implements systems across multiple engineering teams. PKI and key-management expertise are advantages, while deep distributed-systems and security expertise are central.

Requirements

12+ years of experience designing and operating large-scale distributed systems or infrastructure services, with a proven track record of driving multi-team technical strategy into production.
Deep expertise in distributed-systems architecture, reliability, and performance at scale.
Hands-on experience operating mission-critical, highly available services on public cloud platforms such as AWS or GCP, including Kubernetes and service mesh.
Security domain experience in identity and authorization, applied cryptography, or infrastructure security.
Working knowledge of PKI, X.509 certificates, mutual TLS, and key management.
Proven leadership in aligning cross-organizational initiatives without direct authority.
Strong communication skills, including a track record of authoring adopted architecture proposals and presenting effectively to engineers and executives.
A demonstrated, genuine AI-first approach to engineering, using AI to move faster, build fluency across the stack, and contribute beyond one's core specialty.
Experience using AI tools such as Claude Code, GitHub Copilot, Codex, or Cursor in development workflows.
A related technical degree.

Nice To Haves

Built or operated certificate, identity, or key-management services at scale.
Familiarity with workload identity standards such as SPIFFE and short-lived credentials.
Knowledge of post-quantum cryptography standards such as ML-KEM and ML-DSA, hybrid key exchange in TLS 1.3, and emerging approaches such as Merkle Tree Certificates and crypto-agility design principles.
Contributions to technical standards bodies such as IETF, the CA/Browser Forum, or NIST, or to major open-source projects.

Responsibilities

Own the target architecture and multi-year strategy for certificate lifecycle, trust distribution, and cryptographic identity across workloads and AI agents, and lead execution through production.
Architect highly available, globally scalable trust infrastructure with measurable Service Level Objectives and fleet-wide automated certificate renewal capabilities.
Drive automation-first, cost-effective architecture focused on zero-touch lifecycle operations, zero-downtime migrations, and data-driven build-versus-buy decisions.
Establish architectural and security standards for interfaces between the trust platform and dependent infrastructure, and guide teams through complex design trade-offs.
Stay hands-on by prototyping, writing critical-path code, and validating architecture in live systems.
Present investment and architecture proposals to senior leadership, mentor engineering leads, and scale technical expertise across the organization.