Security GRC Lead, Governance Engineering

Salesforce•Bellevue, WA

10d•$148,500 - $246,000

About The Position

Salesforce is seeking a technically strong Security Governance professional to bridge security and compliance requirements with engineering implementation. The role serves as the technical voice and representative of Assurance, partnering with Engineering, Product Security, PCLs, Legal, and other stakeholders to understand how requirements are implemented in real systems and to turn implementation insights into practical, scalable governance requirements. The position evaluates how controls are designed, implemented, operated, and scaled across applications, platforms, infrastructure, cloud environments, and engineering workflows. It translates regulatory, compliance, and security expectations into actionable technical requirements; develops independent second-line oversight; assesses control and risk exposure in mergers and acquisitions; and helps the organization prepare for emerging requirements, including AI governance and evolving international regulations. The role also builds change-management and enablement programs, establishes incident management practices for control failures, develops a network of technical security and control champions, and reports control reliability, coverage, pressure, and systemic risk trends to executive leadership. Success means making controls more technically relevant and easier for Engineering to implement, identifying challenges early, and embedding Assurance as a technical governance partner in secure and compliant engineering practices. U.S. citizenship or permanent residency is required; visa sponsorship is not available. The typical annual base salary range is $148,500–$223,900, or $178,900–$246,000 in select cities in the San Francisco and New York City metropolitan areas. The range excludes bonus, applicable sales incentives, equity, and benefits.

Requirements

U.S. citizenship or permanent residency; visa sponsorship is unavailable.
Strong technical background in security engineering, cloud security, product security, IAM, platform engineering, or security architecture.
Ability to understand complex systems, architectures, APIs, infrastructure, cloud environments, and software development processes.
Experience translating security, risk, regulatory, or compliance requirements into technical implementation requirements.
Strong understanding of security controls and frameworks such as NIST, ISO 27001, SOC, SOX, FedRAMP, or similar frameworks.
Familiarity with emerging technology and regulatory areas such as AI security, AI governance, privacy, and evolving global technology regulations.
Ability to work effectively with Engineering and partner with Legal, Compliance, Security, Risk, and business stakeholders.
Strong communication skills, including explaining technical implementation details to governance teams and translating governance expectations into actionable language for Engineering.
Ability to constructively challenge existing requirements and recommend improvements based on technical realities and risk.

Nice To Haves

Experience with independent control testing, assurance or audit practices, incident or root-cause analysis, or M&A due diligence.

Responsibilities

Serve as a technical liaison between Assurance, Engineering, Product Security, PCLs, Legal, and other stakeholders, ensuring governance requirements are feasible, clear, and implementable.
Evaluate how security and compliance controls are implemented across applications, platforms, infrastructure, cloud environments, and engineering workflows.
Assess control effectiveness and implementation friction, and feed findings into control design, standards, and governance processes.
Translate regulatory, compliance, and security expectations into clear, actionable technical requirements that Engineering can implement and validate.
Develop second-line oversight protocols to independently monitor, audit, and validate operational security controls, including attestations and CRE checks.
Develop an end-to-end understanding of platforms, architectures, engineering processes, security capabilities, and control implementations to inform risk and compliance decisions.
Assess control and risk exposure in mergers and acquisitions; design assessments to price risk, evaluate compatibility, and produce an executable activation plan tied to the risk model.
Partner with Product Security, Legal, PCEs, Market Enablement, and other teams to translate emerging requirements into future security controls and engineering expectations.
Monitor developing regulatory and compliance expectations, including AI governance, the EU AI Act, international requirements, and market-specific regulations, and identify organizational implications.
Build change-management, training, and communications to help teams understand applicable requirements and how to comply.
Establish formal incident management for control failures, including postmortems, root-cause analysis, and control error budgets modeled on availability incident response.
Work with control owners and technical teams to evolve controls in response to new technologies, regulations, architecture changes, and implementation lessons.
Build relationships across Engineering and establish a network of security and control champions to provide feedback, promote requirements, and scale governance.
Report control reliability, coverage, pressure, and systemic risk trends to executive leadership, and feed findings into continuous framework improvement.
Represent Assurance in architecture, engineering, security, and governance discussions, helping involve Assurance early in technical decisions.