> Markdown version of [/jobs/ext/4196102-sr-security-governance-engineer-secure-build-change](https://www.wearedevelopers.com/jobs/ext/4196102-sr-security-governance-engineer-secure-build-change). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Sr. Security Governance Engineer, Secure Build & Change - **Company:** Salesforce.com, Inc. - **Location:** McLean, VA, United States - **Experience:** Expert - **Salary:** $148,500.0 - $246,000.0 - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Microsoft Azure, Cloud Computing, Cloud Computing Security, Control Objectives for Information and Related Technology (COBIT), Continuous Integration, Data Security, Identity and Access Management, Information Security Management, JSON, PCI Data Security Standards, Software Engineering, Management of Software Versions, YAML, Policy as Code, Cloud Platform System, Software Security, Git, National Institute of Standards and Technology Cybersecurity Framework, Hashicorp, RSA Archer Platform, Devsecops - **Published:** October 28, 2026 - **Apply:** https://diversityjobs.com/career/18767359/Sr-Security-Governance-Engineer-Secure-Build-Change-Virginia-Mclean ## About the Role * U.S. Citizenship or Permanent Residency required - we're unable to provide visa sponsorship for this role. * 7+ years in information security governance, security engineering, technology risk, or related functions * Strong grasp of security policies, standards, control frameworks, and governance processes * Familiarity with NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, or PCI DSS * Ability to turn regulatory and security requirements into measurable control objectives * Working knowledge of cloud security (AWS, Azure, or GCP), IAM, application, infrastructure, and data security * Understanding of control design (preventive and detective), risk assessment, and exception management * Familiarity with modern development practices, cloud environments, and CI/CD * Strong analytical, communication, documentation, and stakeholder-management skills Nice to have: * Experience with Governance-as-Code or Policy-as-Code, and policy engines such as OPA/Rego or HashiCorp Sentinel * Familiarity with YAML, JSON, Git, infrastructure-as-code, and DevSecOps * Experience with GRC platforms, Common Controls Frameworks (CCF), and OSCAL * Exposure to security posture management, compliance validation, architecture reviews, or AI governance ## Description As a Sr. Security Governance Engineer, you'll translate enterprise security policies, regulatory requirements, and risk expectations into measurable, technically actionable controls. You'll help build a governance framework where policies and standards are version-controlled, validated, and integrated into engineering workflows. Over time, you'll grow into a Security Control Family Owner for domains such as IAM, Cloud, Application Security, Cryptography, Data Protection, or Infrastructure Security. The focus is governance, control design, and policy ownership. It is not hands-on software development. * Policy and standards: Develop and maintain security policies, technical standards, and control requirements. Manage the policy lifecycle: versioning, approvals, exceptions, reviews, and change management. Keep them aligned with architecture, risk appetite, and regulatory obligations. * Governance-as-Code / Policy-as-Code: Define structured, machine-readable policy and control requirements. Work with engineering to turn them into guardrails and validation criteria, using tools like OPA/Rego or cloud-native policy frameworks. You won't necessarily own the implementation. Review implementations for alignment with policy intent. * Control framework: Maintain a common control framework with clear objectives, ownership, and validation criteria. Establish traceability from regulation to policy to control to implementation. Set expectations for preventive, detective, and compensating controls, and support continuous evaluation of control effectiveness. * Control family ownership: Act as the SME and point of contact for your assigned domains. Interpret regulations, assess gaps, exceptions, and emerging risks, and recommend improvements. * Collaboration: Work with Security Engineering, Product Security, Cloud Security, IAM, Compliance, Risk, Audit, Legal, and business teams. Bring a governance perspective to architecture and design discussions. Expected Outcomes * Decision speed: Rules are obvious, decisions are fast, and outputs are predictable, with governance built into the engineering workflow. * Scalable governance: Policies and control requirements are clear, consistent, and technically actionable. * Governance-as-Code adoption: Requirements are version-controlled, traceable, and integrated into security practices. * Alignment and visibility: Written policies, technical guardrails, and implemented controls match. Regulations, risks, controls, and evidence are clearly linked. * Control family SMEs: Dedicated owners set policy direction and technical standards for each domain.