Security Governance Architect — Policy, Controls & Code

Leadout Capital; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Salesforce is seeking a Sr. Security Governance Engineer to translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls.

You'll help build a governance framework where policies and standards are version-controlled and integrated into engineering workflows. This role focuses on governance, control design, and policy ownership, not hands-on software development.

Qualifications

• 7+ years in information security governance, security engineering, technology risk, or related functions.
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
• Ability to turn regulatory and security requirements into measurable control objectives.
• Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security.

Responsibilities

• Develop and maintain security policies, technical standards, and control requirements.
• Define structured, machine-readable policy and control requirements; review implementations for alignment with policy intent.
• Maintain a common control framework with clear objectives, ownership, and validation criteria.
• Act as SME for assigned domains; interpret regulations, assess gaps, and recommend improvements.
• Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams.

Skills

Security governance

Policy-as-Code

CI/CD

Cloud security

GRC frameworks

Stakeholder mgmt

Tools

OPA/Rego

Job description

Salesforce is seeking a Sr. Security Governance Engineer to translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls.

You'll help build a governance framework where policies and standards are version-controlled and integrated into engineering workflows. This role focuses on governance, control design, and policy ownership, not hands-on software development.