salesforce.com: Product Security Director

Location: San Francisco, CA 94105 Status: Full Time, Employee Job Category: IT/Software Development Description: Salesforce.com has rapidly evolved from a startup founded by four people in a cramped San Francisco apartment in 1999 to a company with more than 2,300 employees, a $700 Million Annual Revenue Run Rate and over 900,000 users worldwide. As a pioneer in on-demand business services, we are transforming the software industry, championing what we call the “democratization” of software—offering small companies the benefits of sophisticated business applications, a luxury previously affordable only for large enterprises. Our customers range in size from tiny companies to global multinational corporations and represent diverse industries. Top talent across the world joins salesforce.com for its “change the world” mentality; the opportunity to excel in a performance-driven, fast-paced, and competitive atmosphere; the chance to be surrounded by peers and leaders that inspire, motivate, and innovate and a corporate philosophy that incorporates community involvement into its fabric. Reporting to the VP of Information Security, you will provide the leadership, vision and direction for Product Security as it supports the company's on-demand CRM service. Work closely with the technology organization to educate our team on secure application development and create innovative security solutions for our product. Additionally, play a key role as you provide both strategic and tactical security advice and develop technology solutions which promote securing customer data including examining new and existing technologies. Responsibilities: Responsibilities include identifying and understanding the networks, infrastructure and development practices that make salesforce.com successful in order to identify the things that can put our success at risk, and then determine how to manage that security risk by designing a comprehensive product security architecture which includes a combination of technical, operational and procedural safeguards. Guide the salesforce.com technology organization's security policy and manage the development and implementation of application vulnerability testing to ensure ongoing maintenance of security. These responsibilities extend to providing input on secure coding practices, log forensics, log design and application code security. The ideal candidate will have in-depth experience protecting against web services security vulnerabilities including cross-site scripting, sql injection, DoS attacks, XML/SOAP and APIs, email security, proxied services such as outbound messaging and viruses. Candidates should have knowledge and understanding of relevant audits and certifications including SAS70s, SYSTRUST and ISO 27001. In addition, this person must have experience with managing source code escrow relationships. Efforts will also include presenting to customers and prospects and meeting with their Information Security experts in order to earn their trust and educate them that our security architecture promotes salesforce.com as a trusted partner capable of securely hosting their corporate information in our service. You may also participate in customer contract negotiations relating to security requirements. Responsibilities may also include developing and managing an information security team that will participate in certifying partner and developer solutions as part of the AppForce certification program Required Skills/Experience: * BS degree (4 year program) * Minimum of 8 years experience in application development, including a minimum of 5 years in product security * Excellent senior leadership and management skills (communication, negotiation, leadership) * Extensive experience interfacing with senior and executive leadership * Ability to demonstrate strategic thinking * Extensive problem solving and analytical skills * Experience leading 24x7xforever support for security in production systems * Current knowledge and exposure with Open Standards such as OASIS SAML/SPML, XML Web Services Security, etc. * Extensive knowledge of the Open Web Application Security Project * Must have a solid understanding of information technology and information security (including firewalls, VPNs, penetration testing and other security devices). * Occasional travel may be required Desired Skills: * Familiarity with multi-platform environments and their operational/security considerations * Knowledge of: UNIX, Oracle, LDAP, NT, Windows 2000, Active Directory, RSA, LANs, WANs, Firewalls, VPN, Routers, Switches, Telecommunications, TCP/IP, SSL/TLS, wireless devices and IPSec * Knowledge of communications networks and architectures including LANs, WANs and Wi-Fi * Knowledge of security and privacy requirements such as Sarbanes-Oxley (section 404), SAS70, ISO 27001, HIPPA, GLB, CA CDPA/SB1386, CAN-SPAM, TrustE, EU Safe Harbor, FDA Regulations and others. * Forensics/Data collection and Auditing Employees at salesforce.com consider their experience as defining points in their careers. If you are ready to become a key contributor and join one of today’s hottest, market-leading companies, then send us your resume and accomplishments today. In return for your efforts, salesforce.com offers a competitive compensation package including on site yoga, healthy snacks, paid-time-off for volunteering and more. Principals only, no agencies please. At salesforce.com equal talent always means equal opportunity. PLEASE APPLY ONLINE AT: http://www.salesforce.com/company/careers/locations/a0800000000Ab4aAAC/a017000000AWnmMAAT.jsp