Security Governance Engineer: Policy, Cloud & IAM Controls

Salesforce, Inc.; Bellevue (WA); On-site; USD 117,000 - 177,000; Full time

Job summary

Salesforce, Inc. is seeking a Sr. Security Governance Engineer to translate policies and risk expectations into measurable controls.

You’ll help build a governance framework with versioned policies and standards and may grow into a Security Control Family Owner for IAM, Cloud, and Data Protection. This role emphasizes governance over hands-on development. You'll collaborate with Security Engineering, Product Security, Compliance, and Legal to ensure controls align with regulatory obligations and

Qualifications

• 2+ years in information security governance, risk or related functions.
• Strong grasp of security policies, standards, control frameworks, and governance processes.
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
• Working knowledge of cloud security (AWS/Azure/GCP), IAM, app/infrastructure security.
• Ability to translate regulatory requirements into measurable control objectives.
• Understanding of control design (preventive and detective) and risk assessment.
• Familiarity with modern development practices, CI/CD and DevSecOps.
• Strong analytical, communication, documentation, and stakeholder-management skills.
• Nice to have Governance-as-Code or Policy-as-Code experience; policy engines like OPA/Rego or Sentinel.
• Familiarity with YAML, JSON, Git, and IaC.

Responsibilities

• Translate enterprise security policies and risk requirements into measurable, actionable controls.
• Develop and maintain a governance framework with versioned policies and standards.
• Grow into a Security Control Family Owner for domains like IAM, Cloud, App Security, Cryptography, Data Protection, or Infrastructure Security.
• Define policy requirements and ensure alignment with architecture, risk appetite, and regulatory obligations.
• Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams.
• Ensure governance is embedded into engineering workflows and validated through audits.

Skills

2+ years governance

Security policies & standards

Governance frameworks

NIST CSF / NIST SP 800-53 / ISO 27001

SOC 2 / PCI DSS familiarity

Cloud security (AWS/Azure/GCP)

Control design & risk assessment

CI/CD awareness

Policy-as-Code / Governance-as-Code

OPA/Rego

HashiCorp Sentinel

YAML / JSON / Git / IaC

Tools

OPA/Rego

HashiCorp Sentinel

OSCAL / GRC platforms

Job description

Salesforce, Inc. is seeking a Sr. Security Governance Engineer to translate policies and risk expectations into measurable controls.

You’ll help build a governance framework with versioned policies and standards and may grow into a Security Control Family Owner for IAM, Cloud, and Data Protection. This role emphasizes governance over hands-on development. You'll collaborate with Security Engineering, Product Security, Compliance, and Legal to ensure controls align with regulatory obligations and