Vulnerability Operations and Response Principal (Information Security)

Salesforce•Mclean, VA

About The Position

The Vulnerability Operations and Response Principal owns the strategy, design, and continuous scaling of Salesforce’s enterprise vulnerability management framework across internal business units, multicloud environments, and emerging AI and machine learning deployments. The role applies a proactive, risk-driven approach to vulnerabilities across infrastructure, software, and AI systems, and serves as a technical authority and strategic operator in partnership with engineering, infrastructure, and product security groups. The position shapes security for Salesforce’s AI-forward platforms, leads vulnerability operations and response, builds governance and assessment frameworks for AI and ML workloads, and develops automated scanning, triage, ticketing, and remediation processes. It also reports systemic security posture, emerging threats, metrics, and SLA performance to executive security leadership and C-level stakeholders.

Requirements

At least 8 years of deep technical experience in enterprise vulnerability management, product security, infrastructure security, or security architecture at cloud scale.
A track record of running vulnerability response across a broad range of stakeholders and maintaining momentum without a clear playbook.
Principal-level expertise in threat-informed vulnerability prioritization frameworks, including CVSS, EPSS, and the KEV catalog, and in vulnerability management lifecycles across diverse multitenant environments.
Strong understanding of emerging AI and ML architectures and security threat models, including LLM security risks, frontier model-based attacks, supply chain vulnerabilities, and AI pipeline exposures.
Proven ability to influence senior engineering and product stakeholders without direct authority and drive rapid, systemic remediation across complex enterprise software environments.
Ability to communicate complex technical risks, systemic vulnerability findings, and strategic remediation roadmaps to executive leaders and nontechnical stakeholders.
Bachelor’s degree in a technical field such as computer science, cybersecurity, information systems, or engineering, or equivalent technical education.

Nice To Haves

Experience building automated CI/CD security gating, automated ticket routing, and orchestration workflows.
Hands-on experience securing containerized environments such as Kubernetes and Docker, and infrastructure-as-code tools such as Terraform and CloudFormation.
Certifications such as CISSP, CISM, or specialized cloud or security architecture credentials.

Responsibilities

Own the internal Vulnerability Operations roadmap and drive strategy and execution across infrastructure, container and microservice ecosystems, and secure development.
Build and enforce security governance and vulnerability assessment frameworks for AI and ML workloads, covering model supply chain risks, prompt injection pathways, shadow AI deployments, and data pipeline exposures.
Support critical vulnerability response operations, lead high-profile vulnerability incidents, and improve incident processes for internal and partner teams.
Partner with Product Management, Engineering, and Architecture leaders to build capabilities that reduce vulnerability exposure across the vulnerability lifecycle.
Design continuous automated scanning, intelligent triage, and ticketing orchestration pipelines to reduce manual work and streamline remediation without creating operational bottlenecks.
Report systemic posture trends, emerging AI threat vectors, model vulnerability metrics, and cross-group SLA performance to executive security leadership and C-level stakeholders.