Security GRC Lead, Forward Deployed Assurance

About the role

Salesforce is looking for a technically strong Security Governance professional to act as the technical voice of Assurance. The role bridges Security and Compliance requirements with Engineering implementation, partnering with Engineering, Product Security, Legal and other stakeholders to turn security and compliance needs into practical, scalable governance requirements.

Key responsibilities

• Bridge Assurance and Engineering, making sure governance requirements are technically feasible and implementable
• Evaluate how security and compliance controls are implemented in applications, platforms, infrastructure, cloud environments and engineering workflows
• Turn regulatory, compliance and security expectations into clear, actionable technical requirements for Engineering teams
• Develop second-line oversight protocols that independently monitor and validate that controls are operational
• Build a deep understanding of platforms, architectures, engineering processes and security capabilities
• Assess control and risk exposure during M&A, and assess emerging security requirements such as AI governance and the EU AI Act
• Drive change management, training and communication, and run a formal control incident management practice with postmortems and error budgets
• Influence future control design and build a network of security champions across Engineering
• Report on control reliability, coverage and systemic risk trends to executive leadership

Required profile

• U.S. citizenship or permanent residency required; visa sponsorship is not provided
• Strong technical background in security engineering, cloud security, product security, IAM, platform engineering or security architecture
• Experience translating security, risk, regulatory or compliance requirements into technical implementation requirements
• Ability to work with Engineering while partnering with Legal, Compliance, Security, Risk and business stakeholders
• Experience with independent control testing, assurance or audit practices, incident or root-cause analysis, or M&A due diligence is a plus

Required skills

• Understanding of security controls and frameworks such as NIST, ISO 27001, SOC, SOX, FedRAMP or similar
• Familiarity with AI security, AI governance, privacy and evolving global technology regulations
• Strong communication skills, able to explain technical details to governance teams and translate them for Engineering teams