Risk & Compliance Lead/Manager, Salesforce

• Demonstrated ability of 5+ years in security governance, risk management, compliance, audit, internal controls, or other security related areas and a minimum of 7-10 years of total work experience
• In-Depth technical background with a good understanding of security concepts and practical usage (Network Engineering, Network Security, Threat and Vulnerability Management, Database, SDLC, and Release Management)
• Understanding of the Common Vulnerability Scoring System (CVSS) and other vulnerability risk scoring systems used in the industry
• Detail oriented with excellent written communication skills that is required to support delivery of high quality risk acceptance case documentation to leadership
• Familiarity with regulatory compliance frameworks (NIST CSF & 800-53, ISO27001, SOX, SOC, HITRUST, HIPAA, FedRAMP, PCI, etc.)
• Experience in security related data analysis, creating metrics and dashboards and summarizing large data sets
• Ability to work with both business and technical areas and translate between the two areas
• Skilled at building rapport, establishing partnerships and strong verbal communication skills
• Excellent interpersonal and organizational skills with an ability to communicate results to multiple levels of management
• Innovative operational process design and process improvement implementation skills
• Proven desire to learn new skills and innovate
• Agile, proactive, comfortable working with ambiguous specifications and can prioritize quickly and optimally
• Drive improvements in existing processes and develop new innovative and efficient solutions
• Ability to work optimally with a wide variety of individuals including developers, systems administrators, executives, customers, regulators, auditors, etc
• Experience working with Cloud technologies/environments
• CISSP, CISA, CISM, AWS or similar certifications
• Demonstrable Experience with Information Security, GRC, ERM, Technology, Business, and Legal/Privacy functions

Desirable

• Salesforce’s Security, Governance, Risk, and Compliance (GRC) Team is responsible for enterprise wide GRC processes, ensuring Salesforce leadership has the information needed to make strategic risk-based decisions enabling the achievement of Salesforce business objectives
• Our team designs and ensures common governance, risk, and compliance processes across the Enterprise
• Security GRC team members understand business objectives, assess security risk of meeting those business objectives, and ensure that we have the appropriate controls in place to mitigate security risks and meet the needs of our global customer base
• GRC’s role is critical in maintaining customer trust to ensure ongoing compliance and risk management
• In this role, you will be part of the Security Issues & Exceptions Management(IEM) program team and responsible to deliver exceptional quality security risk acceptance decisions in partnership with Engineering collaborators, security partners, and other members of GRC to help reduce risk and ensures ongoing compliance for our customers
• You are expected to lead the area of responsibility with minimal guidance from senior team members
• You should innovate, challenge the status quo, embrace operational excellence standard processes and use automation and emerging technologies to enhance delivery of your work product
• Understand, assess and formally articulate security risks and Salesforce Security Standards for which our engineering partners are seeking exceptions
• Deliver high quality risk acceptance documentation with clearly articulated risks and business impact to leadership for their approval
• Ensure that remediation action plans are designed to appropriately mitigate security risk
• Support business and product release commitments by driving risk acceptance for unmitigated security risks across key partners
• Find opportunities to collaborate across Security and product engineering collaborators to reduce risk of non-compliance with internal or external requirements
• Consult with business or security partners on information security requirements and applicability to their business processes, products, or services
• Create and maintain relationships with key business, legal, Employee Success, Internal Audit, technical/engineering collaborators, and other organizations throughout the company who guide in security requirements and Security Risk detection programs
• Focus on continuous improvement of operational processes and designing innovative and automated functionality for added efficiency
• Identify and create metrics and dashboards to quantify and measure the impact of security Issues & exceptions management (IEM) processes that you drive
• Effectively communicate Risk Acceptance positions and programs to applicable business partners