Cloud Security Architect

Overview of the Role As a Cloud Security Architect you will drive the security‑related efforts for the design, implementation, and maintenance of secure cloud environments leveraging cloud‑native services. You will bridge the gap between Product Engineering, Compliance, and Cloud Infrastructure, developing and communicating a converged cloud security vision. You will build secure architectural blueprints, proactively identify and resolve systemic risks, and advocate "security by design". By leveraging threat modeling, infrastructure as code, and AI‑enabled automation you will reduce technical debt and defend against modern threats across public cloud architectures, with a strong emphasis on GCP and foundational AWS environments. Responsibilities Cloud Infrastructure Security: Security Baselines & Standards: Define foundational security baselines and design architectures that align with industry frameworks (NIST, CIS, ISO 27001) across multi‑cloud environments, with a primary focus on GCP and core baselines in AWS. Identity & Governance: Design scalable IAM structures and organizational hierarchies to enforce strict least‑privileged access, including retrofitting legacy access models. Systemic Risk Mitigation: Partner with Offensive Security, Threat & Vulnerability Management, and engineering leadership to identify and prioritize complex vulnerabilities and architectural tech debt. Drive remediation strategies across current and legacy environments to reduce risks to acceptable levels. Detection & Response: Ensure seamless telemetry integration for the Cybersecurity Operations Center (CSOC) and Enterprise Security to enable actionable security posture management. Native Tooling & Guardrails: Proficiency with Google Cloud Native Security Services (e.g., Chronicle, Cloud Armor, Certificate Manager, KMS, Secret Manager, DLP). Architecture & Threat Modeling: Comprehensive Threat Modeling: Lead deep‑dive threat modeling sessions across both product architectures and cloud infrastructure, analyzing data flows, API integrations, and trust boundaries to identify key threats before deployment. Architecture Reviews: Conduct periodic security reviews of new product designs and cloud environment topologies, proposing concrete remediation guidance and "secure‑by‑default" design patterns. Security Advocacy: Serve as the primary Subject Matter Expert, explaining complex technical security concepts to diverse stakeholders to ensure seamless integration. Modern Cloud Architecture & Automation: Infrastructure & Control Guidance: Develop actionable blueprints and provide strategic guidance to engineering teams implementing and automating IAM, network security, and data protection controls. Pipeline Guardrails (CI/CD): Define strict security guardrails (e.g., policy‑as‑code, Terraform linters) and partner with DevOps to integrate them into the CI/CD pipeline, ensuring resources are provisioned securely by default. Container Security Posture: Establish architectural standards for securing the Kubernetes (GKE) footprint, defining requirements for pod security standards, network policies, and container image scanning. AI & Security Automation: Leverage AI‑enabled security posture management tools to analyze telemetry, scale identification of systemic risks, and provide automated remediation guidance to developers. Required Qualifications 15+ years of progressive experience in cybersecurity, including significant time in Cloud Security Architecture or Senior Cloud Security Engineering. Deep, demonstrable understanding of public cloud platforms, primarily GCP with foundational knowledge of AWS, including native security services, complex IAM trust policies, and network perimeters. Experience leveraging AI‑enabled security platforms and automation strategies to scale risk identification and integrate guardrails into engineering workflows. Proven track record of leading deep‑dive threat modeling sessions and bridging the gap between product requirements and infrastructure implementation. Strong proficiency with Infrastructure as Code (Terraform) and securing containerized workloads (Kubernetes/GKE). Deep knowledge of security frameworks (NIST, CIS, ISO 27001), compliance regulations, and modern cloud security best practices. Preferred Qualifications Strategic Influence: Ability to define security strategy for multiple business units and influence stakeholders from DevOps to the C‑Suite. Communication: Skilled at translating "security‑speak" into actionable business logic for non‑technical partners. Analytical Rigor: Proactive problem‑solver who builds patches and processes to prevent vulnerabilities. Accommodations If you need a reasonable accommodation during the application or recruiting process, please submit a request via the Accommodations Request Form. Posting Statement Salesforce is an equal‑opportunity employer and maintains a policy of non‑discrimination with all employees and applicants for employment. All employees and applicants are assessed on the basis of merit, competence, and qualifications without regard to race, religion, color, national origin, sex, sexual orientation, gender expression or identity, transgender status, age, disability, veteran or marital status, political viewpoint, or any other classification protected by law. Benefits Salesforce offers a range of benefits to support work‑life balance and wellness, including paid time off, medical, dental, vision, mental health support, paid parental leave, life and disability insurance, 401(k), and an employee stock purchasing program. Compensation is determined by location, level, and experience, with salary ranges reported separately for each role. Pursuant to the San Francisco Fair Chance Ordinance and the Los Angeles Fair Chance Initiative for Hiring, Salesforce will consider qualified applicants with arrest and conviction records. Salesforce commits to equitable compensation practices across all regions. The base salary range for this role is $218,400–$365,200 annually; select cities may have a range of $263,200–$401,400. #J-18808-Ljbffr salesforce.com, inc.