M&A Security Integration Engineer, PMTS

About the Role

Salesforce is seeking an M&A Security Integration Engineer to join its Mergers and Acquisitions (M&A) Security team. This role is crucial for securely and efficiently integrating newly acquired businesses. The engineer will serve as the primary security partner for these companies, guiding them through the integration process, conducting gap assessments, and ensuring they meet Salesforce's security standards.

Key Responsibilities

• Create comprehensive integration plans for security workstreams with risk-based integration priorities.
• Drive and close security work required to bring acquired businesses under organizational frameworks such as MSA, DPA, and SPARC.
• Perform comprehensive infrastructure assessments on acquired environments.
• Communicate clearly and empathetically with newly acquired business partners to collaboratively bridge security gaps.
• Prioritize critical security work in a dynamic, fast-paced M&A environment.
• Execute robust threat models using the STRIDE methodology.
• Independently drive work streams from start to finish with minimal oversight.
• Continuously innovate M&A security workflows, integration processes, and automation capabilities.

Requirements & Tech Stack

• Degree in Cybersecurity, Computer Science or a relevant subject area, or equivalent experience.
• Basic coding knowledge for application security (e.g., scripting, Bash, Terraform).
• Deep understanding of the CIA Triad (Confidentiality, Integrity, and Availability).
• Demonstrated ability to prioritize complex security workflows and remediation efforts.
• Proficiency in executing threat models using STRIDE.
• Strong understanding of direct and transitive dependencies, as well as broader supply chain risks.
• Ability to independently perform infrastructure assessments.
• Well-versed in Cloud Security Posture Management (CSPM).
• Excellent communication skills, with the ability to tailor messaging, requiring patience and leadership.
• Versed in integrating and interpreting SAST and DAST tooling.
• Strong understanding of Zero Trust network architecture.
• Expertise across Control, Data, and Application plane security.
• Proficiency in secrets management best practices.
• Deep knowledge of the path to production and build pipeline security (spanning source, build, artifact repository, and production deployment).
• Experience with code and binary signing practices.
• Experience with bug categorization and severity mapping.
• Proficiency in data classification standards.
• Clear understanding of what MSA, DPA, and SPARC frameworks entail for enterprise security.
• Familiarity with SOC2 compliance requirements and controls.

Qualifications

• Preferred Information security certifications (e.g., OSCP, OSEP, GPEN, GXPN, CISSP) or cloud security certifications.
• Preferred contributions to the infosec community (participation in bug bounty programs, public research, blogging, presentations, etc.).
• Experience in M&A, due diligence, or integration security, or in third-party security assessment under tight deal timelines.