Security Governance Engineer: Policy, Controls & Code

Salesforce, Inc.; San Francisco (CA); On-site; USD 117,000 - 177,000; Full time

Job summary

Salesforce, Inc. is seeking a Sr. Security Governance Engineer to translate policy, regulatory requirements, and risk expectations into measurable, actionable controls.

You will help build a governance framework where policies are version-controlled, validated, and integrated into engineering workflows. Over time you’ll own governance domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security, focusing on policy ownership and control design rather

Qualifications

• U.S. Citizenship or Permanent Residency required — we’re unable to provide visa sponsorship for this role.
• 2+ years in information security governance, security engineering, technology risk, or related functions
• Strong grasp of security policies, standards, control frameworks, and governance processes
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS
• Ability to turn regulatory and security requirements into measurable control objectives
• Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security
• Understanding of control design (preventive and detective), risk assessment, and exception management
• Familiarity with modern development practices, cloud environments, and CI/CD
• Strong analytical, communication, documentation, and stakeholder-management skills

Responsibilities

• Policy and standards: Develop and maintain security policies, technical standards, and control requirements. Manage the policy lifecycle: versioning, approvals, exceptions, reviews, and change management. Keep them aligned with architecture, risk appetite, and regulatory obligations.
• Governance-as-Code / Policy-as-Code: Define structured, machine-readable policy and control requirements. Work with engineering to turn them into guardrails and validation criteria, using tools like OPA/Rego or cloud-native policy frameworks. You won’t necessarily own the implementation. Review implementations for alignment with policy intent.
• Control framework: Maintain a common control framework with clear objectives, ownership, and validation criteria. Establish traceability from regulation to policy to control to implementation. Set expectations for preventive, detective, and compensating controls, and support continuous evaluation of control effectiveness.
• Control family ownership: Act as the SME and point of contact for your assigned domains. Interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements.
• Collaboration: Work with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams. Bring a governance perspective to architecture and design discussions.

Skills

Information security governance

Security engineering

Risk management

Policy & standards

CI/CD / DevSecOps

Cloud security (AWS/Azure/GCP)

Communication

Tools

OPA/Rego

HashiCorp Sentinel

OSCAL

Job description

Salesforce, Inc. is seeking a Sr. Security Governance Engineer to translate policy, regulatory requirements, and risk expectations into measurable, actionable controls.

You will help build a governance framework where policies are version-controlled, validated, and integrated into engineering workflows. Over time you’ll own governance domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security, focusing on policy ownership and control design rather