Sr. Security Governance Engineer - Protect, Detect, & Respond

Salesforce; Washington; On-site; USD 150,000 - 210,000; Full time

Job summary

Salesforce, Inc. is seeking a Sr. Security Governance Engineer to translate security policies and regulatory requirements into measurable controls and to own governance for multiple domains.

You will collaborate across engineering and security teams to build a scalable governance framework and ensure policy alignment with architecture and risk appetite. Focus areas include policy ownership, policy-as-code, and continuous improvement of control effectiveness across IAM, cloud, and data security

Qualifications

• 7+ years in information security governance, security engineering, technology risk, or related functions.
• Strong grasp of security policies, standards, control frameworks, and governance processes.
• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
• Ability to turn regulatory and security requirements into measurable control objectives.
• Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security.
• Understanding of control design (preventive and detective), risk assessment, and exception management.
• Familiarity with modern development practice.

Responsibilities

• Policy and standards: Develop and maintain security policies, technical standards, and control requirements; manage lifecycle.
• Governance as Code / Policy as Code: Define structured, machine-readable policy requirements and guardrails with engineering alignment.
• Control framework: Maintain a common framework with ownership and validation criteria; support evaluation of effectiveness.
• Control family ownership: Act as SME for assigned domains; assess gaps, exceptions and emerging risks.
• Collaboration: Work with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams.

Skills

Policy & Standards

Governance as Code

Policy as Code

Control framework

Control ownership

Collaboration

OPA

Rego

Tools

OPA

Rego

Job description

Job Category

Software Engineering

Job Details

About Salesforce

Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn't a buzzword - it's a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all.

Ready to level-up your career at the company leading workforce transformation in the agentic era? You're in the right place! Agentforce is the future of AI, and you are the future of Salesforce.

About the team

Assurance at Salesforce is being rebuilt as an engineering discipline. Legacy GRC runs on spreadsheets, screenshots, and an annual scramble to prove controls worked months ago. We're replacing it with a model that is continuous, automated, and built into how Salesforce ships. Controls are code. Evidence comes from pipelines, not people chasing tickets.

Risk-informed, control managed. We monitor, validate, and improve the controls that stand against threats and failures.

Visibility and invention. We give Salesforce a clear, current view of its security posture, and we invest in the people who build it.

Always in front. Nothing waits for the next audit to surface.

You’ll have real ownership, a real roadmap, and the chance to define what modern assurance looks like for the industry.

What you’ll be doing:

As a Sr. Security Governance Engineer, you’ll translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. You’ll help build a governance framework where policies and standards are version-controlled, validated, and integrated into engineering workflows. Over time, you’ll grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security. The focus is governance, control design, and policy ownership. It is not hands‑on software development.

• Policy and standards: Develop and maintain security policies, technical standards, and control requirements. Manage the policy lifecycle: versioning, approvals, exceptions, reviews, and change management. Keep them aligned with architecture, risk appetite and regulatory obligations.


• Governance-as-Code / Policy-as-Code: Define structured, machine-readable policy and control requirements. Work with engineering to turn them into guardrails and validation criteria, using tools like OPA/Rego or cloud-native policy frameworks. You won’t necessarily own the implementation. Review implementations for alignment with policy intent.


• Control framework: Maintain a common control framework with clear objectives, ownership and validation criteria. Set expectations for preventive, detective, and compensating controls, and support continuous evaluation of control effectiveness.


• Control family ownership: Act as the SME and point of contact for your assigned domains. Interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements.


• Collaboration: Work with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams. Bring a governance perspective to architecture and design discussions.

Expected Outcomes

• Decision speed: Rules are obvious, decisions are fast, and outputs are predictable, with governance built into the engineering workflow.


• Scalable governance: Policies and control requirements are clear, consistent, and technically actionable.


• Governance-as-Code adoption: Requirements are version-controlled, traceable, and integrated into security practices.


• Alignment and visibility: Written policies, technical guardrails, and implemented controls match. Regulations, risks, controls, and evidence are clearly linked.


• Control family SMEs: Dedicated owners set policy direction and technical standards for each domain.

What you should have:

U.S. Citizenship or Permanent Residency required - we're unable to provide visa sponsorship for this role.

• 7+ years in information security governance, security engineering, technology risk, or related functions


• Strong grasp of security policies, standards, control frameworks, and governance processes


• Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS


• Ability to turn regulatory and security requirements into measurable control objectives


• Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security


• Understanding of control design (preventive and detective), risk assessment, and exception management


• Familiarity with modern development practice