Senior GRC Policy Operations Analyst

100 Salesforce, Inc.; Washington; On-site; USD 117,000 - 177,000; Full time

Job summary

Salesforce is seeking an Analyst to join the Security Governance team, owning day-to-day standards and policy operations across engineering, IT, and product teams. You will triage intake, draft standards, manage end-to-end review cycles, and publish to the eGRC platform, ensuring alignment with obligations like SOC 2 and ISO 27001.

The role requires 3+ years in security governance, US citizenship or PR, and direct security-domain experience.

Qualifications

• 3+ years in security governance, GRC, technical writing, program management, or compliance operations at a software/product tech company.
• U.S. Citizenship or Permanent Residency. We are unable to provide visa sponsorship for this role.
• Direct security-domain experience (AppSec, cloud security, IAM, vulnerability management, or GRC-adjacent) - read controls, understand risk, and challenge a requester's draft.

Responsibilities

• Prioritize: triage intake for new/updated standards, policies, and control documents - assign owners and timelines.
• Build: draft and finalize standards in plain language with crisp technical requirements.
• Facilitate: own the review/approval cycle end-to-end - schedule CAB reviews, prep read-aheads, capture decisions, track actions.
• Manage: publish approved standards to the eGRC platform and retire superseded documents.
• Operate: keep the standards register traceable to external obligations (SOC 2, ISO 27001, FedRAMP, EU AI Act, NIST CSF) to internal SFSS controls.
• Maintain: run content reviews so every standard has an owner, current review date, and ownership map.
• Monitor: build dashboards on standards health - coverage, freshness, exception load, adoption signals.
• Improve: support onboarding of new standards driven by high-priority initiatives.
• Announce: coordinate stakeholder communications - changelogs, briefings, Slack updates.
• Partner: work with Exception Management to ensure a paired exception path with defined approvals.
• Optimize: improve operating model to reduce cycle time without sacrificing quality.
• Advance: responsibly use AI/GenAI tooling to accelerate drafting and redlining with human review.

Skills

Security governance

GRC

Policy writing

Git

OSCAL

Markdown

Cross-functional collaboration

Tools

Salesforce eGRC

ServiceNow GRC

Archer

OneTrust

LogicGate

Job description

Salesforce is seeking an Analyst to join the Security Governance team, owning day-to-day standards and policy operations across engineering, IT, and product teams. You will triage intake, draft standards, manage end-to-end review cycles, and publish to the eGRC platform, ensuring alignment with obligations like SOC 2 and ISO 27001.

The role requires 3+ years in security governance, US citizenship or PR, and direct security-domain experience.