# Sr. Security Governance Engineer

**Company**: Salesforce
**Location**: Bellevue, Washington
**Experience**: senior
**Job type**: full-time
**Salary**: $117,200 - $176,700 annually
**Category**: Security
**Industry**: Technology

**Apply**: https://salesforce.wd12.myworkdayjobs.com/en-US/External_Career_Site/job/Washington---Bellevue/Security-Governance-Engineer---Secure--Build---Change_JR366461?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_72b3c0fe-336

## Description

As a Sr. Security Governance Engineer at Salesforce, you'll translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. You'll help build a governance framework where policies and standards are version-controlled, validated, and integrated into engineering workflows. Over time, you'll grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security.

Responsibilities:

- Develop and maintain security policies, technical standards, and control requirements.

- Manage the policy lifecycle: versioning, approvals, exceptions, reviews, and change management.

- Define structured, machine-readable policy and control requirements.

- Work with engineering to turn them into guardrails and validation criteria, using tools like OPA/Rego or cloud-native policy frameworks.

- Maintain a common control framework with clear objectives, ownership, and validation criteria.

- Establish traceability from regulation to policy to control to implementation.

- Act as the SME and point of contact for your assigned domains.

- Interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements.

- Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams.

Expected Outcomes:

- Decision speed: Rules are obvious, decisions are fast, and outputs are predictable, with governance built into the engineering workflow.

- Scalable governance: Policies and control requirements are clear, consistent, and technically actionable.

- Governance-as-Code adoption: Requirements are version-controlled, traceable, and integrated into security practices.

- Alignment and visibility: Written policies, technical guardrails, and implemented controls match. Regulations, risks, controls, and evidence are clearly linked.

- Control family SMEs: Dedicated owners set policy direction and technical standards for each domain.

Requirements:

- U.S. Citizenship or Permanent Residency required.

- 2+ years in information security governance, security engineering, technology risk, or related functions.

- Strong grasp of security policies, standards, control frameworks, and governance processes.

- Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.

- Ability to turn regulatory and security requirements into measurable control objectives.

- Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security.

- Understanding of control design (preventive and detective), risk assessment, and exception management.

- Familiarity with modern development practices, cloud environments, and CI/CD.

- Strong analytical, communication, documentation, and stakeholder-management skills.

Nice to have:

- Experience with Governance-as-Code or Policy-as-Code, and policy engines such as OPA/Rego or HashiCorp Sentinel.

- Familiarity with YAML, JSON, Git, infrastructure-as-code, and DevSecOps.

- Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL.

- Exposure to security posture management, compliance validation, architecture reviews, or AI governance.

Benefits:

- Time off programs

- Medical, dental, vision

- Mental health support

- Paid parental leave

- Life and disability insurance

- 401(k)

- Employee stock purchasing program

For more fresh new jobs, check out [yubhub.co](https://yubhub.co/).

## Skills

### Required
- security policies
- control frameworks
- governance processes
- cloud security
- IAM
- application security
- infrastructure security
- data security

### Nice to have
- Governance-as-Code
- Policy-as-Code
- OPA/Rego
- HashiCorp Sentinel
- YAML
- JSON
- Git
- infrastructure-as-code
- DevSecOps

---

Source: [Apply at salesforce.wd12.myworkdayjobs.com](https://salesforce.wd12.myworkdayjobs.com/en-US/External_Career_Site/job/Washington---Bellevue/Security-Governance-Engineer---Secure--Build---Change_JR366461?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)