Senior Security Governance Engineer, Secure Build & Change

Salesforce

. Translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls .

Posted 10/27/2026full-timeUnited StatesSenior💰 $148,500 - $223,900 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in translating regulatory requirements into actionable security controls, with a strong focus on governance, risk management, and compliance. Proficient in cloud security, policy frameworks, and control design, ensuring alignment with enterprise security policies and standards.

Highest-signal resume keywords

Information Security GovernanceCloud Security (AWS, Azure, GCP)NIST CSF, NIST SP 800-53, ISO 27001Governance-as-Code or Policy-as-CodeControl Design (Preventive and Detective)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Security PoliciesControl FrameworksRisk AssessmentException ManagementAnalytical SkillsDocumentation SkillsStakeholder ManagementControl Effectiveness EvaluationCompliance ValidationArchitecture Reviews

Soft Skills

Communication SkillsCollaboration Skills

Tools & Technologies

OPA/RegoHashiCorp SentinelYAMLJSONGitGRC PlatformsCommon Controls Frameworks (CCF)OSCALCI/CDDevSecOps

Industry Keywords

Security GovernanceTechnology RiskData ProtectionApplication SecurityInfrastructure SecuritySecurity Posture ManagementCompliance StandardsControl RequirementsPolicy VersioningChange Management

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud Platform

About the role

Key responsibilities & impact

Translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls
Develop and maintain security policies, technical standards, and control requirements
Manage policy versioning, approvals, exceptions, reviews, and change management
Define structured, machine-readable policy and control requirements
Work with engineering to turn requirements into guardrails and validation criteria using tools such as OPA/Rego or cloud-native policy frameworks
Review implementations for alignment with policy intent
Maintain a common control framework with objectives, ownership, and validation criteria
Establish traceability from regulation to policy to control to implementation
Set expectations for preventive, detective, and compensating controls
Support continuous evaluation of control effectiveness
Serve as SME and point of contact for assigned control-family domains
Interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements
Collaborate with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams
Bring a governance perspective to architecture and design discussions
Grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security

Requirements

What you’ll need

U.S. Citizenship or Permanent Residency required
7+ years in information security governance, security engineering, technology risk, or related functions
Strong grasp of security policies, standards, control frameworks, and governance processes
Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS
Ability to turn regulatory and security requirements into measurable control objectives
Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security
Understanding of control design (preventive and detective), risk assessment, and exception management
Familiarity with modern development practices, cloud environments, and CI/CD
Strong analytical, communication, documentation, and stakeholder-management skills
Experience with Governance-as-Code or Policy-as-Code, and policy engines such as OPA/Rego or HashiCorp Sentinel
Familiarity with YAML, JSON, Git, infrastructure-as-code, and DevSecOps
Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL
Exposure to security posture management, compliance validation, architecture reviews, or AI governance

Benefits

Comp & perks

Time off programs
Medical insurance
Dental insurance
Vision insurance
Mental health support
Paid parental leave
Life insurance
Disability insurance
401(k)
Employee stock purchasing program
Reasonable accommodation during the application or recruiting process