Security Governance Engineer - Policy, Controls & Code

Salesforce, Inc.; McLean (VA); On-site; USD 117,000 - 177,000; Full time

Job summary

Salesforce is seeking a Sr. Security Governance Engineer in the McLean, VA area to translate enterprise security policies and regulatory requirements into measurable, actionable controls.

You will shape governance frameworks, own policy-as-code initiatives, and partner across Security, IAM, Compliance, and Engineering teams to ensure risk is managed effectively. The role focuses on governance, control design, and policy ownership rather than hands-on development, with growth into Security

Qualifications

• U.S. Citizenship or Permanent Residency required.
• 2+ years in information security governance or related fields.
• Strong grasp of security policies, standards and governance processes.
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
• Ability to turn regulatory requirements into measurable control objectives.
• Working knowledge of cloud security (AWS, Azure, or GCP).
• Understanding of control design and risk assessment.
• Familiarity with CI/CD and modern development practices.
• Strong analytical, communication, documentation, and stakeholder-management skills.

Responsibilities

• Develop and maintain security policies, technical standards, and control requirements.
• Define policy and control requirements as policy-as-code using OPA/Rego or cloud-native frameworks.
• Maintain a common control framework with clear objectives, ownership, and validation criteria.
• Act as SME for assigned domains; interpret regulations, assess gaps, and risks.
• Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal and business teams.

Skills

Security governance

Policy development

Cloud security

Risk assessment

Stakeholder management

Tools

OPA/Rego

HashiCorp Sentinel

YAML

Git

Job description

Salesforce is seeking a Sr. Security Governance Engineer in the McLean, VA area to translate enterprise security policies and regulatory requirements into measurable, actionable controls.

You will shape governance frameworks, own policy-as-code initiatives, and partner across Security, IAM, Compliance, and Engineering teams to ensure risk is managed effectively. The role focuses on governance, control design, and policy ownership rather than hands-on development, with growth into Security