Sr. Security Governance Engineer, Secure Build & Change

Salesforce•McLean, VA

13d•$148,500 - $246,000

About The Position

Salesforce is hiring a Sr. Security Governance Engineer to translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. The role focuses on governance, control design, and policy ownership rather than hands-on software development. The engineer will help build a governance framework in which policies and standards are version-controlled, validated, and integrated into engineering workflows, with the opportunity to grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security. The position develops and maintains security policies, technical standards, and control requirements, and manages policy lifecycle processes including versioning, approvals, exceptions, reviews, and change management. It defines structured, machine-readable policy requirements and works with engineering teams to turn them into guardrails and validation criteria, reviewing implementations for alignment with policy intent. The role also maintains a common control framework, establishes traceability from regulations through policies and controls to implementations, supports continuous evaluation of control effectiveness, and serves as a subject-matter expert for assigned control domains. The engineer collaborates with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams, contributing a governance perspective to architecture and design discussions. Expected outcomes include faster and more predictable decisions, scalable and technically actionable policies, increased Governance-as-Code adoption, clear alignment between written policies and implemented controls, and dedicated control-family ownership. The team treats assurance as an engineering discipline: work uses version control, code review, CI/CD, and backlogs; manual work is considered for automation; control gaps become alerts and workflows; and success is measured by risk reduction, effort saved, and reduced audit friction. Salesforce describes opportunities to grow in either engineering or risk disciplines.

Requirements

U.S. citizenship or permanent residency is required; visa sponsorship is not available.
At least 7 years of experience in information security governance, security engineering, technology risk, or related functions.
Strong understanding of security policies, standards, control frameworks, and governance processes.
Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS.
Ability to translate regulatory and security requirements into measurable control objectives.
Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application security, infrastructure security, and data security.
Understanding of control design, including preventive and detective controls, risk assessment, and exception management.
Familiarity with modern development practices, cloud environments, and CI/CD.
Strong analytical, communication, documentation, and stakeholder-management skills.

Nice To Haves

Experience with Governance-as-Code or Policy-as-Code and policy engines such as OPA/Rego or HashiCorp Sentinel.
Familiarity with YAML, JSON, Git, infrastructure-as-code, and DevSecOps.
Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL.
Exposure to security posture management, compliance validation, architecture reviews, or AI governance.

Responsibilities

Develop and maintain security policies, technical standards, and control requirements.
Manage policy lifecycle processes, including versioning, approvals, exceptions, reviews, and change management.
Define structured, machine-readable policy and control requirements.
Work with engineering teams to translate requirements into guardrails and validation criteria, and review implementations for alignment with policy intent.
Maintain a common control framework with clear objectives, ownership, and validation criteria.
Establish traceability from regulations to policies, controls, and implementations.
Set expectations for preventive, detective, and compensating controls and support continuous evaluation of control effectiveness.
Serve as the subject-matter expert and point of contact for assigned control domains; interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements.
Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams.
Bring a governance perspective to architecture and design discussions.