Security Governance Engineer: Policy-as-Code & Controls

Salesforce, Inc.; McLean (VA); On-site; USD 117,000 - 177,000; Full time

Job summary

Salesforce, Inc. is seeking a Sr. Security Governance Engineer to translate security policies and regulatory requirements into measurable controls.

You will shape a governance framework, embed policy as code, and drive cross-functional collaboration with security, product, cloud, IAM, and compliance teams. Growth into domain-level control ownership is expected. The role emphasizes governance and policy ownership rather than hands-on software development, with a focus on scalable, automated

Qualifications

• 2+ years in information security governance, security engineering, technology risk, or related functions.
• Strong grasp of security policies, standards, control frameworks, and governance processes.
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
• Ability to translate regulatory and security requirements into measurable control objectives.
• Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application security, infrastructure security.
• Understanding of control design (preventive and detective), risk assessment, and exception management.
• Familiarity with modern development practices, cloud environments, and CI/CD.
• Strong analytical, communication, documentation, and stakeholder-management skills.

Responsibilities

• Translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls.
• Help build a governance framework where policies and standards are version-controlled, validated, and integrated into engineering workflows.
• Grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security.
• Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams.

Skills

Governance-as-Code

Policy-as-Code

OPA/Rego/Sentinel

YAML/JSON

GRC platforms

Cloud security

CI/CD

Stakeholder management

Job description

Salesforce, Inc. is seeking a Sr. Security Governance Engineer to translate security policies and regulatory requirements into measurable controls.

You will shape a governance framework, embed policy as code, and drive cross-functional collaboration with security, product, cloud, IAM, and compliance teams. Growth into domain-level control ownership is expected. The role emphasizes governance and policy ownership rather than hands-on software development, with a focus on scalable, automated