Sr. Security Governance Engineer

As a Sr. Security Governance Engineer at Salesforce, you'll translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. You'll help build a governance framework where policies and standards are version-controlled, validated, and integrated into engineering workflows. Over time, you'll grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security.

Responsibilities:

• Develop and maintain security policies, technical standards, and control requirements.
• Manage the policy lifecycle: versioning, approvals, exceptions, reviews, and change management.
• Define structured, machine-readable policy and control requirements.
• Work with engineering to turn them into guardrails and validation criteria, using tools like OPA/Rego or cloud-native policy frameworks.
• Maintain a common control framework with clear objectives, ownership, and validation criteria.
• Establish traceability from regulation to policy to control to implementation.
• Act as the SME and point of contact for your assigned domains.
• Interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements.
• Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams.

Expected Outcomes:

• Decision speed: Rules are obvious, decisions are fast, and outputs are predictable, with governance built into the engineering workflow.
• Scalable governance: Policies and control requirements are clear, consistent, and technically actionable.
• Governance-as-Code adoption: Requirements are version-controlled, traceable, and integrated into security practices.
• Alignment and visibility: Written policies, technical guardrails, and implemented controls match. Regulations, risks, controls, and evidence are clearly linked.
• Control family SMEs: Dedicated owners set policy direction and technical standards for each domain.

Requirements:

• U.S. Citizenship or Permanent Residency required.
• 2+ years in information security governance, security engineering, technology risk, or related functions.
• Strong grasp of security policies, standards, control frameworks, and governance processes.
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
• Ability to turn regulatory and security requirements into measurable control objectives.
• Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security.
• Understanding of control design (preventive and detective), risk assessment, and exception management.
• Familiarity with modern development practices, cloud environments, and CI/CD.
• Strong analytical, communication, documentation, and stakeholder-management skills.

Nice to have:

• Experience with Governance-as-Code or Policy-as-Code, and policy engines such as OPA/Rego or HashiCorp Sentinel.
• Familiarity with YAML, JSON, Git, infrastructure-as-code, and DevSecOps.
• Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL.
• Exposure to security posture management, compliance validation, architecture reviews, or AI governance.

Benefits:

• Time off programs
• Medical, dental, vision
• Mental health support
• Paid parental leave
• Life and disability insurance
• 401(k)
• Employee stock purchasing program