Sr. Security GRC Analyst, Forward Deployed Assurance

Salesforce•Atlanta, GA

6d•$117,200 - $194,200

About The Position

The Sr. Security GRC Analyst serves as a technical liaison between Assurance and Engineering, helping bridge security and compliance requirements with their implementation in real systems. The role partners with Engineering, Product Security, PCLs, Legal, and other stakeholders to understand how controls are designed, implemented, operated, and scaled across the enterprise, and to translate findings into practical governance requirements. The analyst evaluates security and compliance controls across applications, platforms, infrastructure, cloud environments, and engineering workflows; develops feedback loops to refine controls and reduce operational friction; and executes second-line oversight to independently monitor, audit, and validate control operations. The role also assesses control and risk exposure in M&A, tracks emerging regulatory developments including AI governance and the EU AI Act, and supports enablement, incident reviews, remediation, metrics, and leadership reporting. Success means making requirements more usable for Engineering, surfacing implementation challenges early, incorporating emerging expectations before they become compliance gaps, and helping Assurance act as a technical governance partner that shapes secure and compliant engineering practices by design. U.S. citizenship or permanent residency is required; visa sponsorship is not available.

Requirements

U.S. citizenship or permanent residency; visa sponsorship is not available.
Relevant experience or technical background in security engineering, cloud security, product security, IAM, platform engineering, or IT governance.
Ability to understand complex systems, architectures, APIs, infrastructure, cloud environments, and software development processes.
Experience translating security, risk, regulatory, or compliance requirements into technical implementation requirements.
Strong understanding of security controls and frameworks such as NIST, ISO 27001, SOC, SOX, FedRAMP, or similar frameworks.
Familiarity with emerging technology and regulatory areas such as AI security, AI governance, privacy, and evolving global technology regulations.
Ability to work effectively with Engineering and partner with Legal, Compliance, Security, Risk, and business stakeholders.
Strong communication skills, including explaining technical implementation details to governance teams and translating governance expectations into actionable language for Engineering.
Analytical mindset and ability to evaluate requirements and provide constructive input based on practical constraints.

Nice To Haves

Experience with independent control testing, assurance or audit practices, incident or root-cause analysis, or M&A due diligence.

Responsibilities

Support technical liaison activities between Assurance, Engineering, Product Security, PCLs, and Legal, ensuring governance requirements are understood and actionable.
Work with Engineering teams to evaluate how security and compliance controls are implemented across applications, platforms, infrastructure, cloud environments, and engineering workflows.
Assess control effectiveness and operational friction, and feed findings into control design, standards, and governance processes.
Translate regulatory, compliance, and security expectations into clear, actionable technical requirements for Engineering teams.
Execute second-line oversight protocols to independently monitor, audit, and validate security controls, including attestations and CRE checks.
Develop an end-to-end understanding of platforms, architectures, engineering processes, security capabilities, and control implementations to inform risk and compliance decisions.
Assess control and risk exposure during M&A; design assessments to price risk, evaluate compatibility, and create executable activation plans tied to the risk model.
Collaborate with Product Security, Legal, PCEs, Market Enablement, and other teams on emerging requirements and their translation into security controls and engineering expectations.
Monitor evolving regulatory and compliance expectations, including AI governance, the EU AI Act, international requirements, and market-specific regulations, and identify organizational implications.
Contribute to change management, documentation, and training to help Engineering understand and comply with policies and standards.
Participate in control incident reviews and postmortems, support root-cause analysis, and track remediation for control failures.
Provide control owners with feedback on effectiveness and suggest refinements based on operational findings and engineering feedback.
Engage security and control champions across Engineering to gather feedback, distribute guidance, and support governance adoption.
Track and report metrics on control coverage, compliance trends, and risk items for management reporting.
Represent Assurance in engineering and operational discussions and integrate compliance considerations early in development cycles.