Sr. Security GRC Analyst, Forward Deployed Assurance

Salesforce•Bellevue, WA

About The Position

Salesforce is seeking a technically strong Security Governance professional to bridge security and compliance requirements with Engineering implementation. The role serves as a technical liaison and representative for Assurance, partnering with Engineering, Product Security, PCLs, Legal, and other stakeholders to understand how requirements are implemented in real systems and to turn operational insights into practical, scalable governance requirements. The analyst evaluates how controls are designed, implemented, operated, and scaled across applications, platforms, infrastructure, cloud environments, and engineering workflows. The role translates regulatory, compliance, and security expectations into actionable technical requirements, performs independent second-line oversight, and helps Assurance make informed risk and compliance decisions. It also contributes to M&A risk assessments, emerging security and AI governance requirements, control incident reviews, enablement, and leadership reporting. Success means strengthening the connection between Assurance expectations and Engineering practices, identifying implementation challenges early, improving the technical relevance and usability of controls, and helping leadership understand control reliability and systemic risk.

Requirements

U.S. citizenship or permanent residency; visa sponsorship is not available.
Relevant experience or technical background in security engineering, cloud security, product security, IAM, platform engineering, or IT governance.
Ability to understand complex systems, architectures, APIs, infrastructure, cloud environments, and software development processes.
Experience translating security, risk, regulatory, or compliance requirements into technical implementation requirements.
Strong understanding of security controls and frameworks such as NIST, ISO 27001, SOC, SOX, FedRAMP, or similar frameworks.
Familiarity with emerging technology and regulatory areas such as AI security, AI governance, privacy, and evolving global technology regulations.
Ability to work effectively with Engineering and partner with Legal, Compliance, Security, Risk, and business stakeholders.
Strong communication skills, including explaining technical implementation details to governance teams and translating governance expectations into actionable language for Engineering.
Analytical mindset and ability to evaluate requirements and provide constructive input based on practical constraints.

Nice To Haves

Experience with independent control testing, assurance or audit practices, incident or root-cause analysis, or M&A due diligence.

Responsibilities

Support technical liaison activities between Assurance, Engineering, Product Security, PCLs, and Legal, ensuring governance requirements are clearly understood and actionable.
Work with Engineering teams to understand how security and compliance controls are implemented across applications, platforms, infrastructure, cloud environments, and engineering workflows.
Assess which controls and requirements work well, create unnecessary friction, or are unclear or difficult to operationalize; feed findings into control design, standards, and governance processes.
Translate regulatory, compliance, and security expectations into clear, actionable technical requirements that Engineering teams can consistently implement and validate.
Execute second-line oversight protocols to independently monitor, audit, and validate that security controls are operational across Engineering teams, including attestations and CRE checks.
Develop an end-to-end understanding of platforms, architectures, engineering processes, security capabilities, and control implementations to inform Assurance risk and compliance decisions.
Assess control and risk exposure during M&As; design assessments to price risk, evaluate compatibility, and deliver an executable activation plan tied to the risk model.
Collaborate with Product Security, Legal, PCEs, Market Enablement, and other teams on emerging requirements and their implications for future security controls and engineering expectations.
Monitor evolving regulatory and compliance expectations, including AI governance, the EU AI Act, international requirements, and market-specific regulations, and identify organizational implications.
Contribute to change management, documentation, and training to help Engineering teams understand and comply with policies and standards.
Participate in control incident reviews and postmortems, assist with root-cause analysis, and track remediation for control failures.
Work with control owners to provide feedback on control effectiveness and recommend refinements based on operational findings and Engineering feedback.
Engage with security and control champions across Engineering to gather feedback, distribute guidance, and support governance adoption.
Track and report metrics on control coverage, compliance trends, and risk items for management reporting.
Represent Assurance in engineering and operational discussions and help integrate compliance considerations early in development cycles.