Software Engineering Architect, PKI & Trust Services

Salesforce•San Francisco, CA

12d•$218,400 - $401,400

About The Position

Salesforce is hiring a Software Engineering Architect for PKI and Trust Services. The role defines the technical direction for infrastructure that issues certificates, establishes workload and AI-agent identity, distributes trust, and protects cryptographic keys across a global, multi-cloud platform. The architect will guide the evolution of certificate lifetimes, automated lifecycle management, and post-quantum cryptography while maintaining service availability and avoiding disruption to dependent services. This is a hands-on architecture role requiring deep distributed-systems and security expertise. The architect will set strategy, lead production execution across multiple engineering teams, develop and validate systems in live environments, and provide technical leadership across the organization.

Requirements

12+ years of experience designing and operating large-scale distributed systems or infrastructure services, with a proven track record of driving multi-team technical strategy into production.
Deep expertise in distributed-systems architecture, reliability, and performance at scale.
Hands-on experience operating mission-critical, highly available services on public cloud platforms such as AWS or GCP, including Kubernetes and service mesh.
Security domain experience in identity and authorization, applied cryptography, or infrastructure security.
Working knowledge of PKI, X.509 certificates, mutual TLS (mTLS), and key management.
Proven leadership aligning cross-organizational initiatives without direct authority.
Strong communication skills, including authoring adopted architecture proposals and presenting effectively to engineers and executives.
Demonstrated, genuine AI-first approach to engineering, using AI to move faster, build fluency across the stack, and contribute beyond one's core specialty.
Experience using AI tools such as Claude Code, GitHub Copilot, Codex, or Cursor in development workflows.
A related technical degree.

Nice To Haves

Built or operated certificate, identity, or key-management services at scale.
Familiarity with workload identity standards such as SPIFFE and short-lived credentials.
Knowledge of post-quantum cryptography standards such as ML-KEM and ML-DSA, hybrid key exchange in TLS 1.3, and emerging approaches such as Merkle Tree Certificates and crypto-agility design principles.
Contributions to technical standards bodies such as the IETF, CA/Browser Forum, or NIST, or to major open-source projects.

Responsibilities

Own the target architecture and multi-year strategy for certificate lifecycle, trust distribution, and cryptographic identity across workloads and AI agents, and lead execution through production.
Architect highly available, globally scalable trust infrastructure with measurable Service Level Objectives and fleet-wide automated certificate renewal capabilities.
Drive automation-first, cost-effective architecture focused on zero-touch lifecycle operations, zero-downtime migrations, and data-driven build-versus-buy decisions.
Establish architectural and security standards for interfaces between the trust platform and dependent infrastructure, and guide teams through complex design trade-offs.
Prototype, write critical-path code, and validate architecture in live systems.
Present investment and architecture proposals to senior leadership, mentor engineering leads, and scale technical expertise across the organization.