Senior GRC Analyst: Common Controls & Frameworks

salesforce.com, inc.; Bellevue (WA); On-site; USD 117,000 - 194,000; Full time

Job summary

Salesforce is seeking a results-driven Analyst to support the Common Controls Framework (CCF) operations. You will act as a trusted advisor to security and compliance stakeholders across the business, helping design, implement, and improve controls that support multiple certification programs.

You’ll map controls to frameworks, update lifecycle documentation, and streamline assessment processes. The role requires strong communication, cross-functional collaboration, and a proactive approach to

Qualifications

• 3+ years in security governance, GRC, or compliance operations at a tech company.
• Direct security-domain experience (application security, cloud security, IAM, vulnerability management, or GRC-adjacent).
• Ability to write clear, concise standards, policies, or procedures non-security readers can act on.
• Working knowledge of a major security/privacy framework (SOC 2, ISO 27001, NIST CSF, PCI, HIPAA, EU AI Act).
• Comfort running cross-functional review cycles with Engineering, Legal, Privacy, Product.
• Experience with a GRC platform (Salesforce eGRC, ServiceNow GRC, Archer, OneTrust, LogicGate).
• Excellent written and verbal English communication.

Responsibilities

• Design, maintain, and evolve the CCF across all Salesforce compliance programs.
• Map common controls to applicable frameworks, standards, and certification requirements.
• Maintain and update controls throughout their lifecycle - descriptions, mappings, applicability, implementation guidance.
• Support certification programs by analyzing requirements, identifying control coverage, and streamlining assessment processes and timelines.
• Partner cross-functionally to support CCF adoption and implementation across teams.
• Research emerging regulations, standards, and certification requirements for potential impact on the CCF.
• Develop and maintain reporting, metrics, and analyses on CCF adoption, control coverage, and certification readiness.
• Identify and track control gaps and inconsistencies, escalating to senior team members as needed.
• Stay informed on regulatory trends and share relevant updates with the team.

Skills

Security governance

GRC program management

Technical writing

Compliance operations

English communication

Cross-functional collaboration

Tools

Salesforce eGRC

ServiceNow GRC

Archer

OneTrust

LogicGate

Job description

Salesforce is seeking a results-driven Analyst to support the Common Controls Framework (CCF) operations. You will act as a trusted advisor to security and compliance stakeholders across the business, helping design, implement, and improve controls that support multiple certification programs.

You’ll map controls to frameworks, update lifecycle documentation, and streamline assessment processes. The role requires strong communication, cross-functional collaboration, and a proactive approach to