Senior GRC & Policy Operations Lead

Salesforce; San Francisco (CA); On-site; USD 117,000 - 177,000; Full time

Job summary

Salesforce is seeking an Analyst to join the Security Governance team. You will own the standards lifecycle, from intake and drafting to review, publication, and retirement, ensuring alignment with external obligations and internal controls.

The role requires strong policy writing, governance experience, and the ability to manage multiple stakeholders across engineering, security, and legal. A solid understanding of major frameworks and experience with GRC platforms is essential.

Qualifications

• 3+ years in security governance, GRC, technical writing, program management, or compliance operations at a software/product tech company.
• U.S. Citizenship or Permanent Residency. We are unable to provide visa sponsorship for this role.
• Direct security-domain experience (AppSec, cloud security, IAM, vulnerability management, or GRC-adjacent).
• Proven ability to write clear standards/policies non-security readers can act on.
• Working knowledge of SOC 2, ISO 27001, NIST CSF, FedRAMP, PCI, HIPAA, EU AI Act, or equivalent.
• Experience with Git; familiarity with OSCAL and Markdown.
• Experience with a GRC platform (Salesforce eGRC, ServiceNow GRC, Archer, OneTrust, LogicGate, or similar).
• Excellent written and verbal English communication.
• Ability to work independently across many parallel workstreams.
• Highest level of ethics, independence, and professionalism.

Responsibilities

• Triage intake for new/updated standards, policies, and control documents; assign owners and timelines.
• Draft and finalize standards with SMEs to ensure clear, actionable requirements.
• Own the review/approval cycle end-to-end; schedule CAB reviews and track decisions.
• Publish approved standards to the eGRC platform and retire superseded documents.
• Maintain standards traceability to external obligations (SOC 2, ISO 27001, FedRAMP, EU AI Act, NIST CSF).
• Run content reviews to ensure owner and current review dates exist; flag drift.
• Build dashboards on standards health: coverage, freshness, adoption signals.

Skills

Security governance

GRC

Technical writing

Program management

Compliance operations

English communication

Education

Bachelor's degree in a related field

Tools

Git

OSCAL

Markdown

Salesforce eGRC

ServiceNow GRC

Archer

OneTrust

LogicGate

Job description

Salesforce is seeking an Analyst to join the Security Governance team. You will own the standards lifecycle, from intake and drafting to review, publication, and retirement, ensuring alignment with external obligations and internal controls.

The role requires strong policy writing, governance experience, and the ability to manage multiple stakeholders across engineering, security, and legal. A solid understanding of major frameworks and experience with GRC platforms is essential.