Security GRC Lead: Engineering Governance & Assurance

Salesforce, Inc.; Washington; On-site; USD 150,000 - 190,000; Full time

Job summary

Salesforce, Inc. seeks a technically strong Security Governance professional to bridge Security & Compliance with Engineering.

You will partner with Engineering, Product Security, Legal, and other stakeholders to translate governance requirements into actionable technical implementations across cloud environments. You will evaluate control design and operation, develop second-line oversight, and drive risk-based improvements including during M&A assessments, while aligning security with product

Qualifications

• Translate security, risk, regulatory, or compliance requirements into technical implementation requirements.
• Strong understanding of security controls and frameworks such as NIST, ISO 27001, SOC 2, or SOX.
• Experience translating governance requirements into actionable engineering tasks.

Responsibilities

• Bridge Assurance and Engineering, ensuring governance requirements are technically feasible and actionable.
• Evaluate how security and compliance controls are implemented across apps, platforms, and cloud environments.
• Develop second-line oversight protocols to monitor and validate controls are operating enterprise-wide.
• Drive change management and enablement to shift teams from policy interpretation to concrete, actionable compliance.

Skills

Security governance

Security engineering

Cloud security

Product security

IAM

Regulatory knowledge

Communication

Education

Bachelor's degree in CS or related field

Job description

Salesforce, Inc. seeks a technically strong Security Governance professional to bridge Security & Compliance with Engineering.

You will partner with Engineering, Product Security, Legal, and other stakeholders to translate governance requirements into actionable technical implementations across cloud environments. You will evaluate control design and operation, develop second-line oversight, and drive risk-based improvements including during M&A assessments, while aligning security with product