Someone calls a sales rep, says they are from IT, and walks them through approving “the new Data Loader.” A marketing tool your team installed three years ago still holds a live connection to your Salesforce org. A public help site lets anonymous visitors see more than anyone intended. None of these are flaws in Salesforce itself. All of them have been used to steal Salesforce customer data in the past year.
That is why more companies are now looking for a Salesforce security consultant. The platform is secure by design, but most real-world risk lives in how each org is configured, which apps are connected to it, and what people and now AI agents are allowed to do.
This guide explains why Salesforce security has moved up the agenda, what a Salesforce security consultant does, the tools they work with, the five skills that matter most, credentials and pay, and how to assess candidates.
Table of Contents
Why Salesforce Security Moved Up the Agenda
A series of data theft campaigns against Salesforce customers between 2025 and 2026 made the risks very concrete. They used three main routes.
- Voice phishing through the consent screen. Microsoft’s security team describes attackers who, from mid-2025, called employees while posing as IT support and talked them into authorizing a malicious connected app.
- Stolen tokens from trusted vendors. In August 2025, attackers stole OAuth and refresh tokens from the Salesloft Drift integration and used them to query connected Salesforce orgs, as The Hacker News reported. A Cloud Security Alliance research note counts three successive vendor compromises through mid-2026 and stresses that none of them exploited a Salesforce platform vulnerability.
- Overexposed public sites. According to Software Insights’ timeline, a third route targeted Experience Cloud guest user settings, and Salesforce published guest user guidance in March 2026.
The common thread is configuration, connected apps, and people. Salesforce’s own recommended practices, as reported by BleepingComputer, start with multi-factor authentication, least privilege, and careful management of connected apps. That is the work a Salesforce security consultant is hired to do.
AI agents add a new layer. Agents act on data and call actions, and outside AI tools can now reach Salesforce through new interfaces. Each one needs the same discipline: narrow access, clear permissions, and monitoring.
What a Salesforce Security Consultant Does
Most engagements start with a Salesforce security review, sometimes called a Salesforce security audit, followed by fixes and ongoing governance.
| Area | What the consultant checks and fixes |
|---|---|
| Identity and login | Multi-factor authentication, single sign-on, session settings, login restrictions, and inactive users |
| Access | Profiles, permission sets, admin rights, sharing rules, and who can see sensitive fields |
| Connected apps and integrations | Every OAuth-connected app, its scopes, who can authorize new apps, integration users, and API access |
| Public and external access | Experience Cloud guest user settings, external sharing, and portal user access |
| Data protection | Field classification, encryption, data retention, and sandbox data masking |
| Monitoring | Event logs, alerts for unusual exports or API activity, and an incident response plan |
| AI agents | What each agent can see and do, which actions need approval, and how agent activity is logged |
A good review ends with a prioritized list, not a long report. The best consultants fix the highest-risk items first, such as unused connected apps with broad access or guest users who can see internal records, then put governance in place so the same gaps do not reopen.
That governance often sits with a Center of Excellence. Our guide to building a Salesforce Center of Excellence covers where security fits, and our guide to Salesforce technical debt explains why old configuration is often where risk hides.
Tools: Salesforce Shield, Security Center, and AI Controls
A Salesforce security consultant should know these tools well, and know when each is worth paying for.
| Tool | What it does | Why it matters |
|---|---|---|
| Health Check | A built-in score comparing your security settings to a baseline | A free first look at weak settings |
| Salesforce Shield: Platform Encryption | Encrypts sensitive data at rest, with key management options | Common requirement in regulated industries |
| Salesforce Shield: Event Monitoring | Detailed logs of logins, exports, API calls, and other activity, including near-real-time options | The main way to spot unusual exports or API use |
| Salesforce Shield: Field Audit Trail | Long-term history of changes to important fields | Audit and compliance evidence |
| Security Center | One view of security posture across multiple orgs | Useful for companies with several orgs |
| Einstein Trust Layer | Protections for data sent to AI models, such as masking and data retention controls | The baseline for safe AI use on Salesforce |
Monitoring is where many orgs are weakest. Microsoft’s guidance on the 2025 to 2026 campaigns stresses monitoring OAuth-connected apps and enabling Salesforce event monitoring, and notes that newer monitoring integrations can tie activity to a specific connected app and its granted scopes. A strong candidate will know how to turn those logs into alerts someone actually acts on.
Not every company needs every tool. A good consultant will tell you when settings changes and better processes will close most of the risk before you buy more licenses.
5 Critical Skills of a Strong Salesforce Security Consultant
1. Identity and access design
Single sign-on, multi-factor authentication, profiles, permission sets, and least-privilege design are the foundation. Strong candidates can redesign access in a messy org without breaking how people work.
2. Connected app and integration governance
Given the recent campaigns, this is now one of the most valuable skills. Look for candidates who can inventory every connected app, review its scopes, restrict who can authorize new ones, and lock down integration users.
3. Sharing and external access
Sharing rules, external sharing, and Experience Cloud guest user settings are where small mistakes expose large amounts of data. Our guide to how to hire an Experience Cloud developer covers the portal side.
4. Monitoring and incident response
Knowing what normal looks like, setting alerts for unusual exports or API activity, and having a clear plan for revoking tokens and access when something goes wrong.
5. AI and agent security
Agents need the same least-privilege thinking as people: narrow data access, limited actions, human approval for sensitive steps, and full logging. Candidates who can apply security design to agents are still rare. Our guide to how to hire an Agentforce architect covers the design side.
Useful extras include experience with compliance frameworks relevant to your industry, Shield implementation, and the ability to explain risk clearly to executives and auditors.
Credentials and Pay
Credentials
There is no single Salesforce security certification, so read a combination of signals:
- Salesforce architect credentials focused on security, especially Identity and Access Management Architect and Sharing and Visibility Architect, which cover the two areas where most configuration risk sits.
- Broader Salesforce architect credentials, such as System Architect and, at the top, Certified Technical Architect.
- General security credentials, such as CISSP or CCSP, which show security depth beyond Salesforce.
The strongest candidates combine Salesforce platform depth with real security experience. Verify Salesforce credentials on the credential verification page, and see our guide to the Salesforce certifications that matter when hiring for the wider picture.
Pay
Our 2027 Salesforce salary guide does not break out security as its own band, so use the closest benchmarks:
| Role | Closest benchmark | US base range (2027) |
|---|---|---|
| Salesforce security consultant | Senior technical consultant | $140,000 to $175,000 |
| Senior security consultant or security architect | Technical architect | $160,000 to $230,000 |
Candidates with regulated-industry experience, Shield implementations, or incident response experience sit toward the top of these ranges.
Many companies start with a contract security review rather than a permanent hire. Our guide to Salesforce contractor rates puts technical consultants at $120 to $185 an hour and technical architects at $130 to $210, and our technical debt guide estimates a focused architect-led health check at roughly $10,000 to $25,000.
How to Hire a Salesforce Security Consultant
Walk through a connected app review
Ask: “We have 60 connected apps, some installed years ago by people who have left. How would you find out which ones are risky and fix it without breaking business processes?” Strong candidates talk about inventory, owners, scopes, last-used dates, restricting who can authorize new apps, and a staged cleanup with business sign-off.
Run an incident scenario
Ask what they would do in the first hour if a vendor announced that its Salesforce integration tokens had been stolen. Listen for revoking tokens, checking logs for unusual queries and exports, identifying affected data, and coordinating with legal and communications teams.
Test external access
Ask how they would check what an anonymous visitor can see on your public help site. Candidates who mention testing as a guest user and reviewing guest profile permissions have done this before.
Ask about agents
Ask how they would review an AI agent before launch: its data access, the actions it can take, which steps need human approval, and how its activity is logged.
Check communication
Have them explain one security risk to a non-technical executive in two minutes. A Salesforce security consultant who cannot explain risk clearly will struggle to get fixes funded.
Know where to look
Strong candidates often come from Salesforce partners with security practices, from in-house Salesforce architects who specialized in security, and from security professionals who learned Salesforce deeply. Our comparison of a Salesforce headhunter vs staffing vs placement agency explains which approach fits, and our guide to how to hire Salesforce architects covers the architect side.
Frequently Asked Questions
What does a Salesforce security consultant do?
A Salesforce security consultant reviews and strengthens how a Salesforce org is protected: login and identity, user access, sharing, connected apps and integrations, public site access, data encryption, monitoring, and increasingly the access given to AI agents.
What is a Salesforce security review?
A Salesforce security review, or audit, is a structured check of an org’s security settings and practices, from multi-factor authentication and permissions to connected apps, guest user access, and event monitoring, ending in a prioritized list of fixes.
What is Salesforce Shield?
Salesforce Shield is a set of paid security tools that includes Platform Encryption for sensitive data, Event Monitoring for detailed activity logs, and Field Audit Trail for long-term change history.
Were the 2025 Salesforce data thefts caused by a Salesforce vulnerability?
According to public research, including a Cloud Security Alliance research note, the campaigns relied on social engineering, stolen tokens from third-party integrations, and exposed configurations rather than a flaw in the Salesforce platform itself.
What certifications should a Salesforce security consultant have?
Look for Salesforce architect credentials such as Identity and Access Management Architect and Sharing and Visibility Architect, plus general security credentials such as CISSP or CCSP for broader security depth.
How much does a Salesforce security consultant earn?
Salesforce security consultants generally benchmark against senior technical consultants, roughly $140,000 to $175,000 in US base salary, with security architects at about $160,000 to $230,000.
Close the Gaps Attackers Actually Use
The recent attacks on Salesforce customers did not need a platform flaw. They used phone calls, forgotten integrations, and loose settings. A strong Salesforce security consultant closes those gaps, puts monitoring in place, and brings the same discipline to AI agents. Start with a focused review, fix the highest risks first, and make security part of how every new app, portal, and agent gets approved.
Need a Salesforce security consultant or security architect? Talk to our Salesforce recruiters. We find security specialists who understand both the Salesforce platform and real-world threats, for a one-time review or a permanent role.
