Lead Full Stack Security (Systems & Software) Engineering (GRC)

The Experience

Join the team building the next-generation Security Assurance Governance, Risk, and Compliance (GRC) platform at Salesforce. As a lead full stack engineer, you own the architecture, technical roadmap, and delivery of the platform's core engines, including policy as code, compliance as code, automated evidence collection, telemetry and alerting, and risk evaluation.

You guide distributed feature teams from concept through deployment and shape how AI coding assistants are used across the engineering organization to raise both speed and code quality.

What You'll Actually Be Doing

• Take technical ownership of complex, multi-system initiatives, driving architectural decisions, technical specifications, phase planning, and execution across the delivery lifecycle.
• Architect resilient, cloud-native microservice architectures that process large-scale compliance telemetry, support automated evidence ingestion, and run low-latency risk evaluation engines.
• Partner with Product Management, Security Architects, and GRC leaders to translate business and regulatory strategies into detailed technical roadmaps, milestones, and sprint backlogs.
• Establish engineering standards, perform high-impact code and architecture reviews, enforce secure coding guidelines, and set rigorous continuous integration and continuous delivery (CI/CD) and testing benchmarks across the engineering organization.
• Design and implement extensible Policy as Code and Compliance as Code engines, using Open Policy Agent (OPA) or custom evaluation frameworks, along with runtime platforms such as Cloud Security Posture Management (CSPM) and Endpoint Detection and Response (EDR) tools, that dynamically audit infrastructure and enterprise controls.
• Constrain the outputs of AI coding assistants with declarative, machine-readable rules.
• Lead the design of automated evidence collection pipelines that integrate with multi-cloud environments (Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP)), identity providers, enterprise security tools, CI/CD pipelines, ticketing systems, and corporate productivity applications such as Workday and NetSuite.
• Build dynamic risk analysis engines and auditing interfaces that map continuous technical evidence against major regulatory standards, including National Institute of Standards and Technology (NIST) Special Publication 800-53, International Organization for Standardization (ISO) 27001, and System and Organization Controls (SOC) 2.
• Build and ship high-quality, production-grade software using modern engineering practices, with AI as a core part of your development workflow, pushing the boundaries of AI development tools to deliver secure, optimized, and high-quality code.
• Design and orchestrate complex systems where AI agents integrate seamlessly into human workflows, driving efficiency and innovation at scale.
• Contribute to building and maintaining shared system context, an explicit repository of system designs, constraints, and standards that enables AI to operate accurately and reliably.
• Critically evaluate code, whether human- or AI-generated, for correctness, quality, security, and performance.
• Lead the adoption and integration of AI coding assistants, such as Claude, Gemini, and OpenAI application programming interfaces (APIs), across the engineering lifecycle to improve team productivity, automate test generation, and streamline refactoring.
• Mentor senior and mid-level engineers across time zones, fostering a culture of technical excellence, accountability, and continuous learning.
• Lead cross-functional alignment and technical discussions across a geographically dispersed team that works in an asynchronous-first culture.

You're Our Person If...

• 10 to 12+ years of professional full stack software and systems engineering experience, including 3+ years in a Lead, Staff, or Principal Engineer capacity leading technical projects and distributed engineering teams.
• A proven record of taking complex Software as a Service (SaaS) platforms or enterprise software projects from architectural inception to production delivery.
• The ability to break down ambiguous business requirements into high-level architecture designs, concrete technical epics, and actionable execution plans.
• Deep mastery of both Python and Java, including enterprise frameworks such as FastAPI, Django, Flask, and Spring Boot, and microservice design patterns.
• Advanced proficiency in modern JavaScript or TypeScript frameworks (React, Vue, or Angular), with experience designing scalable component libraries and complex data visualization dashboards.
• Strong expertise in relational databases (PostgreSQL, MySQL), NoSQL and graph databases, distributed data processing, containerization (Docker, Kubernetes), and a public cloud platform (AWS, Azure, or GCP).
• Working knowledge of NIST SP 800-53, ISO/IEC 27001, and SOC 2 Trust Services Criteria.
• Direct experience building or architecting systems around continuous control monitoring, automated audit trails, or policy engine evaluation, such as OPA with the Rego language.
• A demonstrated, genuine AI-first approach to engineering, using AI to move faster, build fluency across the stack, and contribute well beyond your core specialty.
• Experience using AI tools, such as Claude Code, GitHub Copilot, Codex, and Cursor, in development workflows, along with a strategic vision for integrating AI into technical workflows.
• Advanced prompt engineering skills, including the ability to write precise, structured prompts and cultivate the system context that makes AI outputs reliable, secure, and production-ready.
• A related technical degree required.

Even Better If...

• Experience architecting commercial GRC tools, Security Information and Event Management (SIEM) systems, or CSPM systems.
• Practical experience implementing OPA or similar policy-as-code tools at scale.
• Security certifications such as Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), or a cloud security specialty certification.
• Experience with the Salesforce platform, including Lightning Web Components, Apex, and Salesforce Object Query Language (SOQL).