Security Governance Engineer - Secure, Build & Change

Salesforce•Bellevue, WA

About The Position

Salesforce is hiring a Senior Security Governance Engineer to translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. The role focuses on governance, control design, and policy ownership rather than hands-on software development. The engineer will help build a governance framework in which policies and standards are version-controlled, validated, and integrated into engineering workflows, with the opportunity to grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security. The position involves developing and maintaining security policies, technical standards, and control requirements; managing policy lifecycle activities; defining structured, machine-readable requirements; and working with engineering teams to make requirements actionable as guardrails and validation criteria. The engineer will maintain a common control framework, establish traceability from regulations through implementation, support evaluation of control effectiveness, and serve as a subject-matter expert for assigned control domains. The role collaborates with security, compliance, risk, audit, legal, engineering, and business teams. The team treats assurance as an engineering discipline, emphasizing version control, code review, CI/CD, automation, actionable signals, embedded partnerships, and measurable outcomes. Salesforce provides benefits and resources intended to support employee well-being and development. U.S. citizenship or permanent residency is required; visa sponsorship is not available.

Requirements

U.S. citizenship or permanent residency; visa sponsorship is not available.
At least 2 years of experience in information security governance, security engineering, technology risk, or related functions.
Strong grasp of security policies, standards, control frameworks, and governance processes.
Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
Ability to translate regulatory and security requirements into measurable control objectives.
Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security.
Understanding of preventive and detective control design, risk assessment, and exception management.
Familiarity with modern development practices, cloud environments, and CI/CD.
Strong analytical, communication, documentation, and stakeholder-management skills.

Nice To Haves

Experience with Governance-as-Code or Policy-as-Code and policy engines such as OPA/Rego or HashiCorp Sentinel.
Familiarity with YAML, JSON, Git, infrastructure-as-code, and DevSecOps.
Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL.
Exposure to security posture management, compliance validation, architecture reviews, or AI governance.

Responsibilities

Develop and maintain security policies, technical standards, and control requirements.
Manage policy lifecycle processes, including versioning, approvals, exceptions, reviews, and change management.
Keep policies aligned with architecture, risk appetite, and regulatory obligations.
Define structured, machine-readable policy and control requirements.
Partner with engineering teams to translate requirements into guardrails and validation criteria, using tools such as OPA/Rego or cloud-native policy frameworks; review implementations for alignment with policy intent.
Maintain a common control framework with clear objectives, ownership, and validation criteria.
Establish traceability from regulation to policy to control to implementation.
Set expectations for preventive, detective, and compensating controls, and support continuous evaluation of control effectiveness.
Serve as subject-matter expert and point of contact for assigned control domains; interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements.
Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams.
Bring a governance perspective to architecture and design discussions.
Help make governance requirements clear, consistent, technically actionable, version-controlled, traceable, and integrated into security practices.