Senior Security GRC Analyst

We need to output HTML fragment only, with headings

for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Include only sections that have real specific content. Remove boilerplate, navigation, EEO, etc. Keep substantive info. We need to parse the job posting. Key sections: - About Salesforce (intro) maybe "About the role"? The posting includes "About Salesforce" paragraph describing company. Could be "About the role"? The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need to map content to these headings. We have: - "About Salesforce" description: could go under "About the role" (or maybe "About the role" is about the role itself). The posting includes "The Experience" describing the team and role. That could be "About the role". We'll combine. - Responsibilities: "What You'll Actually Be Doing" bullet list. - Requirements: "You're Our Person If..." bullet list (experience, etc.) - Qualifications: maybe "Even Better If..." (preferred qualifications) could be under Qualifications or Skills. Could treat as "Qualifications" for required, and "Skills" for preferred? But we have both Requirements and Qualifications sections. Usually Requirements = mandatory, Qualifications = preferred. We'll put mandatory under Requirements, preferred under Qualifications. - Skills: maybe list of specific skills like CSP Safety, Korean auditors, compliance tooling, AWS, certifications. Those are in "Even Better If...". Could go under Skills. - Benefits: The posting mentions benefits: "Unleash Your Potential" paragraph mentions benefits and resources, then later "Salesforce offers a variety of benefits to help you live well including: time off programs, medical, dental, vision, mental health support, paid parental leave, life and disability insurance, 401(k), and an employee stock purchasing program." Also link. So we have benefits content. - Pay: The posting includes "At Salesforce, we believe in equitable compensation practices... The typical base salary range for this position is $117,200 - $176,700 annually." That's pay info. - Schedule: Not mentioned. No schedule info (like full-time, remote). So we should not include Schedule section. We must not include headings with filler text. So include only sections with real content. We need to output HTML fragment only, no /, no markdown fences. We need to use

for each section heading, then content: either

for prose, or

• for lists. We must preserve all substantive information; do not invent or summarize away detail. So we need to keep the details exactly as given, but we can format. We need to remove boilerplate: lines like "To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts." That's application instruction? Actually it's a note about applying max 3 roles. That's application instruction? Might be considered boilerplate; we should remove it. Also "Job Category Enterprise Technology & Infrastructure" maybe minor metadata; we can drop or fold into short p. The instruction: do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short

  or drop it. So we could include a short p with "Job Category: Enterprise Technology & Infrastructure". But maybe better to drop as minor metadata. The instruction says "fold minor metadata into a short

  or drop it." So we could include a short p at top? But we need to avoid headings for that. Could just drop it. We need to keep all substantive info: the description about Salesforce, the Experience, responsibilities, requirements, qualifications, skills, benefits, pay. Let's extract exact text. From posting: "To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts." -> remove. "Job Category Enterprise Technology & Infrastructure" -> maybe drop. "Job Details About Salesforce Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all. Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce." That's about Salesforce. "The Experience The Global Compliance and Certification (GCC) team is responsible for enterprise-wide compliance processes, ensuring Salesforce leadership has the information needed to make strategic, risk-based decisions. The GCC team is a division within the Product Security Organization, and you'll play a pivotal role in partnering with engineering to translate complex mandates into actionable controls — driving continuous risk mitigation and adherence to Salesforce security frameworks. We're looking for a compliance professional who is energized by the challenge of making complex regulatory requirements clear and actionable. In this role, you'll get to work across engineering, security, and external auditors to shape how Salesforce maintains its global compliance posture — gaining deep experience in cloud security frameworks and audit execution at scale." That's about the role/experience. "What You'll Actually Be Doing Serve as a cloud compliance subject matter expert, supporting internal and external audits — including leading walkthroughs with external assessors — by ensuring effective control implementation across Salesforce environments aligned with ISO 27001, Service Organization Controls (SOC) 1/2, and other regulatory frameworks.Partner with engineering teams to translate complex compliance frameworks and regulatory mandates into clear, actionable deliverables, ensuring timely remediation and clear leadership reporting on progress and residual risk.Identify opportunities to streamline and automate evidence collection, document detailed process playbooks, and drive operational efficiency and continuous improvement.Collaborate with cross-functional partners to operationalize audit recommendations and enhance overall compliance posture.Automate evidence collection and compliance operations to drive operational efficiency and continuous improvement." Note there are no periods between sentences; but we can keep as is. "You're Our Person If... You have 4+ years of experience in IT audit or internal controls, managing global compliance assessments in complex environments with a strong focus on cloud and software-as-a-service (SaaS) platforms.You have prior experience with compliance and regulatory standards across industries and geographies, including ISO 27001, SOC, Health Insurance Portability and Accountability Act (HIPAA), Payment Card Industry (PCI), Health Information Trust Alliance (HITRUST), Sarbanes-Oxley (SOX), and Federal Risk and Authorization Management Program (FedRAMP).You bring strong analytical and problem-solving skills with the ability to assess risks, recommend solutions, and work independently in a fast-paced regulatory environment.You have strong program and stakeholder management experience, including cross-functional leadership, with excellent organizational and documentation skills." "Even Better If... You have experience in CSP Safety and are able to engage with Korean auditorsYou have experience with compliance tooling, control testing automation, or audit workflow platforms.You have technical knowledge of hyperscaler environments such as Amazon Web Services (AWS).You hold one or more relevant certifications such as Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or Certified Information Systems Auditor (CISA)." "Unleash Your Potential When you join Salesforce, you’ll be limitless in all areas of your life. Our benefits and resources support you to find balance and be your best, and our AI agents accelerate your impact so you can do your best. Together, we’ll bring the power of Agentforce to organizations of all sizes and deliver amazing experiences that customers love. Apply today to not only shape the future — but to redefine what’s possible — for yourself, for AI, and the world." Then later: "Accommodations If you need a reasonable accommodation during the application or the recruiting process, please submit a request via this Accommodations Request Form. Please note that Salesforce uses artificial intelligence (AI) tools to help our recruiters assess and evaluate candidates’ resumes and qualifications throughout the recruiting process. Humans will always make any candidate selection and hiring decisions. Please see our Candidate Privacy Statement for more information about how we use your personal data and your rights, including with regard to use of AI tools and opt out options." This is boilerplate; remove. "Posting Statement Salesforce is an equal opportunity employer..." remove. Then benefits paragraph: "Salesforce offers a variety of benefits to help you live well including: time off programs, medical, dental, vision, mental health support, paid parental leave, life and disability insurance, 401(k), and an employee stock purchasing program. More details about company benefits can be found at the following link: https://www.salesforcebenefits.com." Then pay paragraph: "At Salesforce, we believe in equitable compensation practices that reflect the dynamic nature of labor markets across various regions. The typical base salary range for this position is $117,200 - $176,700 annually. The range represents base salary only, and does not include company bonus, incentive for sales roles, equity or benefits, as applicable." We need to keep that. Now we need to structure. Potential sections: - About the role: combine "About Salesforce" + "The Experience". Could be two paragraphs. - Responsibilities: "What You'll Actually Be Doing" list. - Requirements: "You're Our Person If..." list. - Qualifications: maybe "Even Better If..." list (preferred qualifications). Could be under Qualifications. - Skills: maybe we could extract specific skills from Even Better If: CSP Safety, Korean auditors, compliance tooling, control testing automation, audit workflow platforms, AWS, certifications (CRISC, CISSP, CISM, CISA). But those are already in Qualifications. Could treat Qualifications as required, Skills as preferred. But we have both sections; we need to decide. Given the instruction: "Prefer a few substantive sections over many thin ones." So we might combine Qualifications and Skills into one section? But we have headings list includes both Qualifications and Skills. We could include both if they have content. Let's see if we can differentiate. Required qualifications (You're Our Person If...) includes experience, standards, analytical skills, program/stakeholder management. Preferred qualifications (Even Better If...) includes CSP Safety, Korean auditors, compliance tooling, control testing automation, audit workflow platforms, AWS, certifications. Thus we could put Required under Requirements, Preferred under Qualifications, and maybe Skills could be empty; we should not create a Skills section if no specific skill list beyond those. But we could treat the certifications and tooling as Skills. However we already have Qualifications for preferred. To avoid thin sections, we could combine Qualifications and Skills into one section called "Qualifications & Skills". But the instruction says use headings like Qualifications, Skills. It didn't forbid combining but says use those headings for section headings. It says "use

  for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It gives examples but not strict that we must use exactly those headings; we can use them as appropriate. It says "include a section ONLY when the posting has real, specific content for it". So we could have Qualifications section with both required and preferred? But then we would lose distinction. Better to have Requirements (mandatory) and Qualifications (preferred). Skills maybe not needed. Thus we will output sections: About the role, Responsibilities, Requirements, Qualifications, Benefits, Pay. Check if we have any content for Benefits: yes. Pay: yes. Schedule: none, omit. Now we need to