Senior GRC Analyst — Common Controls & AI Governance

Salesforce; San Francisco (CA); On-site; USD 117,000 - 177,000; Full time

Job summary

Salesforce seeks an Analyst to support the Common Controls Framework (CCF) operations. You’ll apply security, GRC, and product-management expertise to advise security and compliance stakeholders across the business.

You’ll map controls to frameworks, update lifecycle documentation, and help streamline certification readiness while collaborating with Engineering, Legal, Privacy, and Product teams.

Qualifications

• 3+ years in security governance, GRC, or compliance at a tech company.
• Direct security-domain experience to read controls and assess risk.
• Clear, concise standards or procedures for non-security readers.
• Working knowledge of SOC 2, ISO 27001, NIST CSF, PCI, HIPAA or equivalent.
• Comfort leading cross-functional reviews with senior stakeholders.
• Experience with a GRC platform such as Salesforce eGRC / ServiceNow GRC.

Responsibilities

• Support the design, maintenance, and evolution of the CCF program across Salesforce certifications.
• Map controls to frameworks and requirements, identifying reuse opportunities.
• Maintain controls lifecycle descriptions, mappings, applicability, and guidance.
• Analyze requirements and streamline assessment timelines for certification.
• Partner cross-functionally to drive CCF adoption and implementation.
• Research regulations and standards affecting CCF and related programs.

Skills

Security governance

GRC

Technical writing

Program management

Compliance operations

SOQL

Tools

Salesforce eGRC

ServiceNow GRC

Archer

OneTrust

LogicGate

Job description

Salesforce seeks an Analyst to support the Common Controls Framework (CCF) operations. You’ll apply security, GRC, and product-management expertise to advise security and compliance stakeholders across the business.

You’ll map controls to frameworks, update lifecycle documentation, and help streamline certification readiness while collaborating with Engineering, Legal, Privacy, and Product teams.