Senior Enterprise Security Risk & Controls Analyst

Salesforce; New York (NY); On-site; USD 90,000 - 130,000; Full time

Benefits offered by this job

Medical Care

Life Insurance

Retirement Savings

Employee Assistance Programs

13 paid days off

Job summary

Salesforce is seeking a Senior Analyst within Enterprise Security to support BISOs in day-to-day engagements with business unit customers. You will track risks, coordinate deliverables, and prepare materials for stakeholder reviews while maintaining credibility and a strong operational rhythm.

Ideal candidates bring 3+ years in a corporate IT or consulting setting, experience with NIST SP 800-53, and a solid grasp of security governance (COSO, CSF).

Qualifications

• 3+ years of experience in consulting or a large corporate IT environment.
• Experience implementing and testing security controls based on NIST SP 800-53.
• Strong understanding of security internal control methodologies and terminology (COSO, CSF).
• Ability to identify and articulate key security risks and develop controls to mitigate them.

Responsibilities

• Maintain an accurate, prioritized risk register for assigned business units, including intake of new findings and status updates.
• Track risk buy-down commitments - owners, dates, status - and flag slippage to the responsible BISO.
• Prepare recurring stakeholder materials (status decks, dashboards, executive read-outs) under BISO direction.
• Coordinate meetings between BISOs, business unit customers, and specialist teams; capture actions and drive follow-up.
• Support BISOs in day-to-day activities and keep engagements running smoothly.

Skills

Risk assessment

Stakeholder communication

Security controls testing

Documentation & reporting

Governance familiarity

Tools

NIST SP 800-53

COSO

CSF

Job description

Salesforce is seeking a Senior Analyst within Enterprise Security to support BISOs in day-to-day engagements with business unit customers. You will track risks, coordinate deliverables, and prepare materials for stakeholder reviews while maintaining credibility and a strong operational rhythm.

Ideal candidates bring 3+ years in a corporate IT or consulting setting, experience with NIST SP 800-53, and a solid grasp of security governance (COSO, CSF).