Policy Analyst

Salesforce is seeking a Policy Analyst to join its Security and Compliance organization. The role focuses on developing and maintaining enterprise security policies, standards, and procedures aligned with NIST SP 800-53, while supporting governance, risk, compliance, audits, and continuous improvement.

Responsibilities:

• Develop, update, and maintain enterprise security policies, standards, and procedures aligned with NIST SP 800-53
• Conduct policy gap assessments and recommend improvements to strengthen compliance and security governance
• Interpret and apply regulatory, contractual, and industry security requirements to internal policies and controls
• Partner with cross-functional stakeholders to ensure policies remain current with evolving business needs and security risks
• Create new policies where none currently exist and enhance existing documentation frameworks
• Support internal and external audits by providing policy documentation, evidence, and compliance artifacts
• Monitor changes in cybersecurity regulations, standards, and best practices, recommending updates as necessary
• Facilitate policy reviews, approvals, communications, and training initiatives
• Maintain documentation repositories and governance processes for policy lifecycle management
• Collaborate with security leadership to drive continuous improvement of the organization's governance framework

Requirements:

• 3+ years of experience in cybersecurity policy development, governance, risk, compliance, or related disciplines
• Expert-level knowledge of NIST SP 800-53 and its implementation within large enterprise environments
• Demonstrated experience authoring, reviewing, and maintaining security policies, standards, and procedures
• Experience supporting compliance initiatives, audits, and security assessments
• Strong understanding of risk management frameworks, security controls, and governance practices
• Excellent written and verbal communication skills with the ability to engage both technical and non-technical stakeholders
• Experience working within large, complex organizations