Platform Security Architect

We are seeking a Salesforce Platform Expert who specializes in security implementation. You are not just a compliance officer; you are a builder. You understand the Salesforce metadata API better than anyone, you know the limits of Apex Managed Sharing, and you know exactly which "Session Settings" break the user experience if configured incorrectly.

In this role, you will be the bridge between our security requirements and the technical reality of the Salesforce platform. You will use your deep platform expertise to architect, configure, and implement the controls that keep our ecosystem secure without sacrificing performance or agility.

The Salesforce Platform Security Architect is responsible for the hands-on design and implementation of security controls within the Salesforce org. You will own the technical configuration of Sharing & Visibility, Shield Encryption, and Identity flows.

You will work alongside developers and admins to ensure that every Flow, Apex Class, and Integration is built securely from the ground up. You translate abstract security policies (e.g., "Least Privilege") into concrete Salesforce configurations (e.g., "Permission Set Groups" and "Field Level Security").

• Sharing Architecture:
  Design and implement complex sharing models. Optimize Org-Wide Defaults (OWD), Sharing Rules, Account Teams, and Territory Management to ensure strict data segregation.
• Shield Implementation:
  Lead the technical deployment of Salesforce Shield. Manage Tenant Secrets, define encryption policies for standard/custom fields, and configure Field Audit Trails to meet retention policies.
• Identity Configuration:
  Configure and troubleshoot SSO (SAML/OIDC), Connected Apps, and Login Flows. managing certificates and Key Management (BYOK) where applicable.

• Real-Time Monitoring:
  Build Transaction Security Policies (using Apex or Low-Code) to block data exfiltration attempts in real-time.
• Log Analysis:
  Configure Event Monitoring to export logs to our SIEM (Splunk/New Relic). Create dashboards to visualize login anomalies and report exports.

• Code Security:
  Act as the "Security Gatekeeper" for deployments. Review Apex and LWC code for common vulnerabilities (SOQL Injection, XSS, Enforcing Sharing).
• Dev Ops Integration:
  Configure static code analysis tools (e.g., PMD, Checkmarx, Clayton) within our CI/CD pipeline (Copado/Gearset/Jenkins) to auto-reject insecure code.

• OAuth Flow Architecture:
  Select and implement the correct OAuth flows for specific use cases (e.g., JWT Bearer Flow for server-to-server integration vs. Web Server Flow for user-facing apps vs. Device Flow for IoT).
• Scope Management:
  Enforce the principle of Least Privilege by meticulously defining and auditing OAuth Scopes (e.g., ensuring an integration only has api access and not full access).
• Session Policies:
  Configure granular session policies per Connected App, enforcing High Assurance sessions (MFA) for sensitive apps and defining strict timeout values.
• Client Secret Management:
  Manage the lifecycle of Consumer Keys and Secrets, including rotation strategies and ensuring secrets are never hardcoded in external systems.
• IP Relaxation: configure "Enforce IP Restrictions" vs. "Relax IP Restrictions" settings on a per-app basis to balance security with accessibility.
• Security Center & Multi-Org Governance
• Centralized Policy Management:
  Implement and manage Salesforce Security Center to define and push baseline security policies (e.g., Password Policies, Session Settings, Trusted IP Ranges) from a central tenant to all child orgs.
• Drift Detection:
  Configure Security Center to monitor for Configuration Drift. Create alerts that trigger immediately if a local admin in a child org attempts to weaken security settings (e.g., disabling MFA or relaxing IP restrictions).
• Health Visibility:
  Maintain a single-pane-of-glass view of security health scores across the entire multi-org landscape, reporting on KPI improvements to leadership.

• Platform Limits:
  Advise the business on the performance impacts of security decisions (e.g., "How will encrypting this field impact SOQL query performance?").
• Release Readiness:
  Review the Salesforce Release Notes (3x/year) specifically for security updates (e.g., MFA enforcement, Browser policy changes) and…