Security Governance Engineer - Secure, Build & Change

Salesforce•McLean, VA

7d•$117,200 - $194,200

About The Position

Salesforce is rebuilding assurance as an engineering discipline, replacing manual, periodic governance processes with continuous, automated controls integrated into engineering workflows. The Security Governance Engineer translates enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. The role focuses on governance, control design, and policy ownership rather than hands-on software development, with the opportunity to grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security. The position develops and maintains security policies, technical standards, and control requirements; manages policy lifecycles; and defines structured, machine-readable requirements that engineering teams can implement as guardrails and validation criteria. It maintains a common control framework and traceability across regulations, policies, controls, implementations, and evidence, while supporting continuous assessment of control effectiveness. As a subject-matter expert for assigned domains, the engineer interprets regulations, assesses gaps and exceptions, and recommends improvements in collaboration with security, engineering, compliance, risk, audit, legal, and business teams. The team works using engineering practices such as version control, code review, CI/CD, and backlogs. It prioritizes automation, actionable signals, embedded partnership, measurable outcomes, and opportunities for growth across governance and engineering disciplines. U.S. citizenship or permanent residency is required; visa sponsorship is unavailable.

Requirements

U.S. citizenship or permanent residency; visa sponsorship is not available.
At least 2 years of experience in information security governance, security engineering, technology risk, or related functions.
Strong grasp of security policies, standards, control frameworks, and governance processes.
Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
Ability to translate regulatory and security requirements into measurable control objectives.
Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application security, infrastructure security, and data security.
Understanding of preventive and detective control design, risk assessment, and exception management.
Familiarity with modern development practices, cloud environments, and CI/CD.
Strong analytical, communication, documentation, and stakeholder-management skills.

Nice To Haves

Experience with Governance-as-Code or Policy-as-Code and policy engines such as OPA/Rego or HashiCorp Sentinel.
Familiarity with YAML, JSON, Git, infrastructure-as-code, and DevSecOps.
Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL.
Exposure to security posture management, compliance validation, architecture reviews, or AI governance.

Responsibilities

Develop and maintain security policies, technical standards, and control requirements.
Manage policy versioning, approvals, exceptions, reviews, and change management, keeping policies aligned with architecture, risk appetite, and regulatory obligations.
Define structured, machine-readable policy and control requirements and work with engineering to translate them into guardrails and validation criteria.
Review engineering implementations for alignment with policy intent.
Maintain a common control framework with clear objectives, ownership, and validation criteria.
Establish traceability from regulations to policies, controls, and implementations.
Set expectations for preventive, detective, and compensating controls and support continuous evaluation of control effectiveness.
Serve as the subject-matter expert and point of contact for assigned control domains; interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements.
Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams, bringing governance perspectives to architecture and design discussions.
Help make governance requirements clear, consistent, technically actionable, version-controlled, traceable, and integrated into security practices and engineering workflows.