Security Governance Engineer - Secure, Build & Change

100 Salesforce, Inc.; Bellevue (WA); On-site; USD 117,000 - 177,000; Full time

Job summary

Salesforce, Inc. is seeking a Sr. Security Governance Engineer to translate policies and risk expectations into measurable controls.

You’ll help build a governance framework with versioned policies and standards and may grow into a Security Control Family Owner for IAM, Cloud, and Data Protection. This role emphasizes governance over hands-on development. You'll collaborate with Security Engineering, Product Security, Compliance, and Legal to ensure controls align with regulatory obligations and

Qualifications

• 2+ years in information security governance, risk or related functions.
• Strong grasp of security policies, standards, control frameworks, and governance processes.
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
• Working knowledge of cloud security (AWS/Azure/GCP), IAM, app/infrastructure security.
• Ability to translate regulatory requirements into measurable control objectives.
• Understanding of control design (preventive and detective) and risk assessment.
• Familiarity with modern development practices, CI/CD and DevSecOps.
• Strong analytical, communication, documentation, and stakeholder-management skills.
• Nice to have Governance-as-Code or Policy-as-Code experience; policy engines like OPA/Rego or Sentinel.
• Familiarity with YAML, JSON, Git, and IaC.

Responsibilities

• Translate enterprise security policies and risk requirements into measurable, actionable controls.
• Develop and maintain a governance framework with versioned policies and standards.
• Grow into a Security Control Family Owner for domains like IAM, Cloud, App Security, Cryptography, Data Protection, or Infrastructure Security.
• Define policy requirements and ensure alignment with architecture, risk appetite, and regulatory obligations.
• Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams.
• Ensure governance is embedded into engineering workflows and validated through audits.

Skills

2+ years governance

Security policies & standards

Governance frameworks

NIST CSF / NIST SP 800-53 / ISO 27001

SOC 2 / PCI DSS familiarity

Cloud security (AWS/Azure/GCP)

Control design & risk assessment

CI/CD awareness

Policy-as-Code / Governance-as-Code

OPA/Rego

HashiCorp Sentinel

YAML / JSON / Git / IaC

Tools

OPA/Rego

HashiCorp Sentinel

OSCAL / GRC platforms

Job description

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts.

Job Category Software Engineering Job Details About Salesforce Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all. Ready to level‑up your career at the company leading workforce transformation in the agentic era? You're in the right place! Agentforce is the future of AI, and you are the future of Salesforce.

What you'll be doing:

As a Sr. Security Governance Engineer, you'll translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. You'll help build a governance framework where policies and standards are version‑controlled, validated, and integrated into engineering workflows. Over time, you'll grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security. The focus is governance, control design, and policy ownership. It is not hands‑on software development.

Policy and standards: Develop and maintain security policies, technical standards, and control requirements. Manage the policy lifecycle: versioning, approvals, exceptions, reviews, and change management. Keep them aligned with architecture, risk appetite, and regulatory obligations.

Governance‑as‑Code / Policy‑as‑Code: Define structured, machine‑readable policy and control requirements. Work with engineering to turn them into guardrails and validation criteria, using tools like OPA/Rego or cloud‑native policy frameworks. You won't necessarily own the implementation. Review implementations for alignment with policy intent.

Control framework: Maintain a common control framework with clear objectives, ownership, and validation criteria. Establish traceability from regulation to policy to control to implementation. Set expectations for preventive, detective, and compensating controls, and support continuous evaluation of control effectiveness.

Control family ownership: Act as the SME and point of contact for your assigned domains. Interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements.

Collaboration: Work with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams. Bring a governance perspective to architecture and design discussions.

Expected Outcomes:

Decision speed: Rules are obvious, decisions are fast, and outputs are predictable, with governance built into the engineering workflow.

Scalable governance: Policies and control requirements are clear, consistent, and technically actionable.

Governance‑as‑Code adoption: Requirements are version‑controlled, traceable, and integrated into security practices.

Alignment and visibility: Written policies, technical guardrails, and implemented controls match. Regulations, risks, controls, and evidence are clearly linked.

Control family SMEs: Dedicated owners set policy direction and technical standards for each domain.

What you should have:

• U.S. Citizenship or Permanent Residency required — we're unable to provide visa sponsorship for this role.
• 2+ years in information security governance, security engineering, technology risk, or related functions
• Strong grasp of security policies, standards, control frameworks, and governance processes
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS
• Ability to turn regulatory and security requirements into measurable control objectives
• Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security
• Understanding of control design (preventive and detective), risk assessment, and exception management
• Familiarity with modern development practices, cloud environments, and CI/CD
• Strong analytical, communication, documentation, and stakeholder‑management skills
• Nice to have: Experience with Governance‑as‑Code or Policy‑as‑Code, and policy engines such as OPA/Rego or HashiCorp Sentinel
• Familiarity with YAML, JSON, Git, infrastructure‑as‑code, and DevSecOps
• Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL
• Exposure to security posture management, compliance validation, architecture reviews, or AI governance

How We Work:

Engineering‑first. We use version control, code review, CI/CD, and backlogs. Assurance work ships like software. Automate first. If it's done manually twice, it's a candidate for a build. Signals, not surprises. Gaps become alerts and workflows, and control failures resolve through defined escalation paths. Embedded partners. We work alongside T&P teams as peers, not gatekeepers, and solve problems with them, not at them. Outcomes over activity. We measure risk reduced, effort saved, and audit friction removed. Room to grow. Learn the engineering side if you come from GRC, or the risk side if you come from engineering. We support both paths.

Accommodations

If you need a reasonable accommodation during the application or the recruiting process, please submit a request via this Accommodations Request Form. Please note that Salesforce uses artificial intelligence (AI) tools to help our recruiters assess and evaluate candidates’ resumes and qualifications throughout the recruiting process. Humans will always make any candidate selection and hiring decisions. Please see our Candidate Privacy Statement for more information about how we use your personal data and your rights, including with regard to use of AI tools and opt out options.

Posting Statement

Salesforce is an equal opportunity employer and maintains a policy of non‑discrimination with all employees and applicants for employment. What does that mean exactly? It means that at Salesforce, we believe in equality for all. And we believe we can lead the path to equality in part by creating a workplace that’s inclusive, and free from discrimination. Know your rights: workplace discrimination is illegal. Any employee or potential employee will be assessed on the basis of merit, competence and qualifications – without regard to race, religion, color, national origin, sex, sexual orientation, gender expression or identity, transgender status, age, disability, veteran or marital status, political viewpoint, or other classifications protected by law. This policy applies to current and prospective employees, no matter where they are in their Salesforce employment journey. It also applies to recruiting, hiring, job assignment, compensation, promotion, benefits, training, assessment of job performance, discipline, termination, and everything in between. Recruiting, hiring, and promotion decisions at Salesforce are fair and based on merit. The same goes for compensation, benefits, promotions, transfers, reduction in workforce, recall, training and education. In the United States, compensation offered will be determined by factors such as location, job level, job‑related knowledge, skills, and experience. Certain roles may be eligible for incentive compensation, equity, and benefits. Salesforce offers a variety of benefits to help you live well including: time off programs, medical, dental, vision, mental health support, paid parental leave, life and disability insurance, 401(k), and an employee stock purchasing program. More details about company benefits can be found at the following link: https://www.salesforcebenefits.com. Pursuant to the San Francisco Fair Chance Ordinance and the Los Angeles Fair Chance Initiative for Hiring, Salesforce will consider for employment qualified applicants with arrest and conviction records. At Salesforce, we believe in equitable compensation practices that reflect the dynamic nature of labor markets across various regions. The typical base salary range for this position is $117,200 - $176,700 annually. In select cities within the San Francisco and New York City metropolitan area, the base salary range for this role is $141,200 - $194,200 annually. The range represents base salary only, and does not include company bonus, incentive for sales roles, equity or benefits, as applicable. We're Salesforce, the Customer Company, inspiring the future of business with AI + Data + CRM. Leading with our core values, we help companies across every industry blaze new trails and connect with customers in a whole new way. And, we empower you to be a Trailblazer, too — driving your performance and career growth, charting new paths, and improving the state of the world. If you believe in business as the greatest platform for change and in companies doing well and doing good – you've come to the right place.