Sr. Security Governance Engineer, Secure Build & Change

Salesforce•Seattle, WA

11d

About The Position

Salesforce is rebuilding assurance as an engineering discipline, replacing manual, periodic governance processes with continuous, automated controls integrated into engineering workflows. The Sr. Security Governance Engineer translates enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. The role focuses on governance, control design, and policy ownership, rather than hands-on software development. The engineer helps establish version-controlled policies and standards that are validated and integrated into engineering practices, and may grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security. The role develops and maintains security policies, technical standards, control requirements, and a common control framework. It defines structured, machine-readable requirements and works with engineering teams to establish guardrails and validation criteria. The engineer maintains traceability across regulations, policies, controls, and implementations; supports continuous evaluation of control effectiveness; and serves as a subject-matter expert and point of contact for assigned security domains. The role collaborates with security, compliance, risk, audit, legal, and business teams, bringing a governance perspective to architecture and design discussions. The team works in an engineering-first way, using version control, code review, CI/CD, and backlogs. It prioritizes automation, actionable signals and workflows, embedded partnership with T&P teams, and outcomes such as reduced risk, saved effort, and less audit friction. Salesforce describes opportunities to grow either engineering or risk expertise. U.S. citizenship or permanent residency is required; visa sponsorship is not available. The typical annual base salary range is $148,500–$223,900, or $178,900–$246,000 in select cities in the San Francisco and New York City metropolitan areas. Base salary excludes applicable bonuses, equity, and benefits.

Requirements

U.S. citizenship or permanent residency; visa sponsorship is unavailable.
At least 7 years of experience in information security governance, security engineering, technology risk, or related functions.
Strong understanding of security policies, standards, control frameworks, and governance processes.
Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
Ability to translate regulatory and security requirements into measurable control objectives.
Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security.
Understanding of preventive and detective control design, risk assessment, and exception management.
Familiarity with modern development practices, cloud environments, and CI/CD.
Strong analytical, communication, documentation, and stakeholder-management skills.

Nice To Haves

Experience with Governance-as-Code or Policy-as-Code and policy engines such as OPA/Rego or HashiCorp Sentinel.
Familiarity with YAML, JSON, Git, infrastructure-as-code, and DevSecOps.
Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL.
Exposure to security posture management, compliance validation, architecture reviews, or AI governance.

Responsibilities

Develop and maintain security policies, technical standards, and control requirements.
Manage the policy lifecycle, including versioning, approvals, exceptions, reviews, and change management.
Keep policies and standards aligned with architecture, risk appetite, and regulatory obligations.
Define structured, machine-readable policy and control requirements and work with engineering teams to turn them into guardrails and validation criteria.
Review implementations for alignment with policy intent; implementation ownership is not necessarily part of the role.
Maintain a common control framework with clear objectives, ownership, and validation criteria.
Establish traceability from regulations to policies, controls, and implementations.
Set expectations for preventive, detective, and compensating controls and support continuous evaluation of control effectiveness.
Serve as the subject-matter expert and point of contact for assigned control domains.
Interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements.
Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams.
Bring a governance perspective to architecture and design discussions.