Security GRC Lead, Governance Engineering

Salesforce•McLean, VA

11d•$148,500 - $246,000

About The Position

Salesforce is seeking a technically strong Security Governance professional to bridge security and compliance requirements with engineering implementation. The role serves as Assurance’s technical liaison with Engineering, Product Security, PCLs, Legal, and other stakeholders. It evaluates how controls are designed, implemented, operated, and scaled across enterprise systems, and translates findings into practical, scalable governance requirements. The position develops engineering-focused oversight and feedback processes, helps teams understand and implement applicable requirements, and informs control design as technologies, architectures, and regulations evolve. It also supports risk assessment during mergers and acquisitions, establishes control-failure incident management, engages technical control champions, and reports on control reliability and systemic risk to executive leadership. The goal is to make Assurance a technical governance partner that helps shape secure and compliant engineering practices by design.

Requirements

U.S. citizenship or permanent residency; visa sponsorship is not available.
Strong technical background in security engineering, cloud security, product security, IAM, platform engineering, or security architecture.
Ability to understand complex systems, architectures, APIs, infrastructure, cloud environments, and software development processes.
Experience translating security, risk, regulatory, or compliance requirements into technical implementation requirements.
Strong understanding of security controls and frameworks such as NIST, ISO 27001, SOC, SOX, FedRAMP, or similar frameworks.
Familiarity with emerging technology and regulatory areas such as AI security, AI governance, privacy, and evolving global technology regulations.
Ability to work effectively with Engineering and partner with Legal, Compliance, Security, Risk, and business stakeholders.
Strong communication skills, including explaining technical implementation details to governance teams and translating governance expectations into actionable language for Engineering.
Ability to constructively challenge existing requirements and recommend improvements based on technical realities and risk.

Nice To Haves

Experience with independent control testing, assurance or audit practices, incident or root-cause analysis, or M&A due diligence.

Responsibilities

Serve as a technical liaison between Assurance, Engineering, Product Security, PCLs, Legal, and other stakeholders, making governance requirements feasible and implementable.
Work with Engineering teams to evaluate how security and compliance controls are implemented across applications, platforms, infrastructure, cloud environments, and engineering workflows.
Assess control effectiveness and implementation friction, and feed findings into control design, standards, and governance processes.
Translate regulatory, compliance, and security expectations into clear, actionable technical requirements.
Develop second-line oversight protocols to independently monitor, audit, and validate operational security controls, including attestations and CRE checks.
Build a detailed understanding of platforms, architectures, engineering processes, security capabilities, and control implementations to inform risk and compliance decisions.
Assess control and risk exposure during mergers and acquisitions; design assessments to price risk, evaluate compatibility, and produce an executable activation plan tied to the risk model.
Partner with Product Security, Legal, PCEs, Market Enablement, and other teams to translate emerging requirements into future controls and engineering expectations.
Monitor evolving regulatory and compliance expectations, including AI governance, the EU AI Act, international requirements, and market-specific regulations, and identify organizational implications.
Develop change management, training, and communications to help teams understand which requirements apply and how to comply.
Establish formal incident management for control failures, including postmortems, root-cause analysis, and control error budgets modeled on availability incident response.
Work with control owners and technical teams to evolve controls in response to new technologies, regulatory expectations, architecture changes, and implementation lessons.
Build relationships with Engineering stakeholders and establish a network of security and control champions to provide feedback, promote requirements, and scale governance.
Report control reliability, coverage, pressure, and systemic risk trends to executive leadership, and feed findings into continuous improvement of the control framework.
Represent Assurance in technical architecture, engineering, security, and governance discussions, ensuring Assurance is involved early.