Security Governance Engineer — Policy & Controls (Policy-as-Code)

Salesforce, Inc.; San Francisco (CA); On-site; USD 117,000 - 177,000; Full time

Job summary

Salesforce, Inc. is seeking a Sr. Security Governance Engineer to translate security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls.

You will help build a governance framework integrated into engineering workflows, with domains like IAM, Cloud, Application Security, and Data Protection. This role emphasizes governance over hands-on development. You will own policy lifecycle, review implementations for alignment, and collaborate with

Qualifications

• U.S. Citizenship or Permanent Residency required
• 2+ years in information security governance, security engineering, technology risk, or related functions
• Strong grasp of security policies, standards, control frameworks, and governance processes
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS
• Ability to turn regulatory and security requirements into measurable control objectives
• Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security
• Understanding of control design (preventive and detective), risk assessment, and exception management
• Familiarity with modern development practices, cloud environments, and CI/CD
• Strong analytical, communication, documentation, and stakeholder-management skills

Responsibilities

• Translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls
• Help build a governance framework where policies and standards are version-controlled, validated, and integrated into engineering workflows
• Grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security
• Policy and standards: Develop and maintain security policies, technical standards, and control requirements; manage policy lifecycle
• Governance-as-Code / Policy-as-Code: Define machine-readable policy and control requirements; validate implementations
• Control framework: Maintain a common framework with objectives, ownership, and validation criteria; ensure traceability

Skills

Security governance

Policy formulation

Cloud security

Risk assessment

CI/CD familiarity

Tools

OPA/Rego

HashiCorp Sentinel

YAML/JSON

Git

Job description

Salesforce, Inc. is seeking a Sr. Security Governance Engineer to translate security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls.

You will help build a governance framework integrated into engineering workflows, with domains like IAM, Cloud, Application Security, and Data Protection. This role emphasizes governance over hands-on development. You will own policy lifecycle, review implementations for alignment, and collaborate with