GRC Security Analyst: Unified Audit Lead

Salesforce, Inc.; San Francisco (CA); On-site; USD 96,300 - 145,200; Full time

Job summary

Salesforce, Inc. is seeking a Security GRC Analyst to lead the Unified Audit program across SOC 2, HIPAA, ISO 27001, and GxP. The role partners with control owners and external auditors to ensure continuous compliance and audit readiness.

The ideal candidate has 2–4 years in GRC or information security, with hands-on experience across multiple frameworks and proficiency in GRC tools and documentation systems.

Qualifications

• 2–4 years of experience in GRC, compliance, audit, or information security.
• Working knowledge of at least two of SOC 2, HIPAA, ISO 27001, or GxP frameworks.
• Proficient with GRC tools, audit management platforms, and documentation systems (MS Office or Google Workspace).
• Clear communication with both technical and non-technical stakeholders; ability to manage multiple deadlines.

Responsibilities

• Lead end-to-end Unified Audit program across SOC 2, HIPAA, ISO 27001, and GxP frameworks, coordinating schedules and minimizing duplication across certifications.
• Manage internal evidence collection by assigning tasks to control owners, tracking deadlines, validating submissions, and conducting pre-audit gap reviews.
• Serve as the primary liaison with external auditors—scheduling walkthroughs, responding to information requests, and coordinating responses to findings.
• Maintain compliance dashboards, standard operating procedures, and documentation repositories to support continuous monitoring and audit readiness.

Skills

GRC knowledge

Audit management

Stakeholder communication

Documentation skills

Tools

GRC tools

Audit platforms

MS Office / Google Workspace

Job description

Salesforce, Inc. is seeking a Security GRC Analyst to lead the Unified Audit program across SOC 2, HIPAA, ISO 27001, and GxP. The role partners with control owners and external auditors to ensure continuous compliance and audit readiness.

The ideal candidate has 2–4 years in GRC or information security, with hands-on experience across multiple frameworks and proficiency in GRC tools and documentation systems.