Security GRC Senior Lead (South Korea)

About the role

Salesforce is looking for a highly skilled and strategic Security GRC Senior Lead based in South Korea. The role reports to the Director, Cyber Security & Compliance Strategist and focuses on engaging external auditors and regulatory bodies in the Korean region and the wider APAC area, while helping review and update the Salesforce product certification roadmap. Fluency in Korean and English is required.

Key responsibilities

• Partner with the customer trust and security enablement teams to communicate the company's cybersecurity practices and commitment to compliance to customers.
• Manage cybersecurity compliance programs and policies aligned with global standards and local regulations.
• Work with the APAC Assurance team and engineering teams to run CSP Safety Assessments and other regional audits efficiently.
• Support the development or refresh of certification artifacts such as an ISMS, risk assessment strategy and security policies and standards.
• Liaise with external auditors and internal teams to support certification audits.
• Stay up to date on emerging cybersecurity threats and best practices.

Required profile

• Minimum 5 years of experience in security governance, risk management, compliance, audit, internal controls or related security areas, and 7-10 years of total work experience.
• Track record of building and aligning teams to organizational compliance needs.
• Bachelor's degree in Information Security, Computer Science or a related field; advanced degrees or certifications such as CISSP, CISA or CISM preferred.
• Fluent Korean and English; additional Asian languages are a plus.

Required skills

• Experience handling CSP Safety audits and certification processes.
• Hands-on experience with AWS and other cloud environments.
• Experience defining security policies, standards and controls.
• Strong understanding of frameworks such as ISO 27001 and NIST Cybersecurity Framework.
• Knowledge of Korean CSP Safety Assessment and Common Controls Framework is essential; familiarity with K-ISMS, CSAP, SOC 2, ISO 27001, ISMAP, MTCS, PCI and NIST is an advantage.