Description
As a Sr. Security Governance Engineer at Salesforce, you'll translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. You'll help build a governance framework where policies and standards are version-controlled, validated, and integrated into engineering workflows. Over time, you'll grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security.
Responsibilities:
- Develop and maintain security policies, technical standards, and control requirements
- Manage the policy lifecycle: versioning, approvals, exceptions, reviews, and change management
- Define structured, machine-readable policy and control requirements
- Work with engineering to turn them into guardrails and validation criteria
- Maintain a common control framework with clear objectives, ownership, and validation criteria
- Establish traceability from regulation to policy to control to implementation
- Act as the SME and point of contact for your assigned domains
- Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams
Expected Outcomes:
- Decision speed: Rules are obvious, decisions are fast, and outputs are predictable, with governance built into the engineering workflow
- Scalable governance: Policies and control requirements are clear, consistent, and technically actionable
- Governance-as-Code adoption: Requirements are version-controlled, traceable, and integrated into security practices
- Alignment and visibility: Written policies, technical guardrails, and implemented controls match
- Control family SMEs: Dedicated owners set policy direction and technical standards for each domain
Requirements:
- 7+ years in information security governance, security engineering, technology risk, or related functions
- Strong grasp of security policies, standards, control frameworks, and governance processes
- Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS
- Ability to turn regulatory and security requirements into measurable control objectives
- Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security
- Understanding of control design (preventive and detective), risk assessment, and exception management
- Familiarity with modern development practices, cloud environments, and CI/CD
- Strong analytical, communication, documentation, and stakeholder-management skills
Nice to have:
- Experience with Governance-as-Code or Policy-as-Code, and policy engines such as OPA/Rego or HashiCorp Sentinel
- Familiarity with YAML, JSON, Git, infrastructure-as-code, and DevSecOps
- Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL
- Exposure to security posture management, compliance validation, architecture reviews, or AI governance