Software Engineering - MTS, Trust Intelligence Platform

Salesforce•San Francisco, CA

3d•$117,200 - $194,200

About The Position

Salesforce is hiring a Member of Technical Staff to build and operate automation that keeps third-party and open-source dependencies across a large service fleet patched, auditable, and shipped on time. The role owns feature-level work on pipelines that discover vulnerable packages, determine upgrades, open fix pull requests across repositories, and track fixes through deployment to production artifacts. The position is aimed at engineers experienced in pipeline and automation work who are interested in developing expertise in software supply chain security. The team will teach relevant standards, including CVE, CVSS, SBOM, SLSA, and Sigstore. The engineer will contribute to data pipelines and repository-wide remediation automation, operate the systems they ship, collaborate with service owners, document systems, and learn the supply chain security domain on the job.

Requirements

At least 3 years of industry software engineering experience.
Strong proficiency in Python and Java.
Reading fluency in at least two of Node.js, Go, and Ruby.
Hands-on experience contributing to batch or streaming data pipelines, including idempotent steps and reasoning about retries.
Direct experience building and maintaining CI/CD pipelines with automated test coverage.
Comfort writing scripts or small services that interact with many repositories, open pull requests, parse diffs, and handle CI feedback.
Experience with a workflow orchestrator such as Airflow, Dagster, Prefect, or Temporal.
Experience with a lakehouse or columnar query engine such as Trino, Presto, Spark, Snowflake, BigQuery, Athena, Databricks, or Iceberg.
SQL skills including non-trivial joins, window functions, and common table expressions (CTEs).
End-to-end feature-level ownership covering design, implementation, deployment, and ongoing maintenance.
B.S. in Computer Science or Engineering, or equivalent experience.

Nice To Haves

Working familiarity with CVE, CVSS v3, EPSS, KEV (CISA), and SBOM formats such as SPDX and CycloneDX.
Direct experience with at least two of Snyk, Trivy, Grype, Dependabot, Renovate, Semgrep SCA, OSV-Scanner, or Dependency-Track.
Exposure to reachability tooling such as Semgrep to prioritize fixes by exploitability rather than raw CVE count.
Experience driving changes across many repositories through GitHub Actions, Dependabot configuration, or custom bots.
Working knowledge of layer-based image scanning and base-image lifecycle management.
Working experience with AWS, Kubernetes, Terraform, and container-based deployment.

Responsibilities

Contribute to data pipelines that ingest vulnerability data, dependency manifests, SBOM artifacts, and deployment metadata into a queryable analytics store.
Build and maintain batch and streaming jobs with idempotent steps, retries, and clear failure modes.
Operate owned pipelines, participate in on-call, debug production failures, and reduce toil through automation.
Build scripts and small services that interact with many repositories, including opening pull requests, parsing diffs, reading CI feedback, and reconciling results to a central store.
Author and maintain CI/CD pipelines with automated test coverage so remediation pull requests can be reviewed and merged confidently.
Resolve attribution issues at their source rather than patching downstream symptoms.
Partner with service owners to land dependency upgrades, triage breakage, and improve generated fix pull requests.
Translate scanner output into prioritized, actionable work for engineering teams.
Write and maintain design documents, runbooks, pull request descriptions, and other documentation as behavior changes.
Write Python and Java code that follows existing codebase conventions and holds up under review.
Add regression tests for every bug fixed and use failing tests as signal.
Learn the supply chain domain, including vulnerability lifecycle, dependency resolution, and artifact provenance, and apply that knowledge to pipelines.