Salesforce Global Risk & Compliance Lead

AVEVA is creating software trusted by over 90% of leading industrial companies.

Job Title:
Salesforce Global Risk & Compliance Lead

Location: London or Cambridge

Employment Type:
full-time

We are seeking a highly experienced Global Risk & Compliance Lead to oversee risk management, security, and compliance for our Sales Enablement platforms, primarily focused on Salesforce. This role is responsible for ensuring that Salesforce solutions meet global regulatory requirements, align with enterprise risk frameworks, and maintain the highest standards of data protection, security, and governance. Reporting to the Sales Enablement Domain Director with a dotted line to the Head of IT GRC, this position collaborates closely with Sales Enablement teams to document control designs, organize evidence collection, manage dependencies (e.g., JML feeds from HR, access reviews by Business Owners), and strengthen Role-Based Access Control (RBAC) structures.

The key objective is to ensure compliance with Sarbanes‑Oxley (SOX) requirements, implement controls from the Crown Jewel Security Playbook (e.g., risk assessments, access reviews, patching, backups), and satisfy the Crown Jewel Security Policy by protecting critical assets through governance, identification, protection, detection, response, and recovery measures.

The ideal candidate will bring deep expertise in compliance, risk management, and Salesforce governance, with the ability to work with globally distributed teams and collaborate across business, legal, and technology functions.

• Define and maintain global compliance and risk frameworks for Salesforce implementation and operations.

• Documenting control designs for Sales Enablement processes, ensuring alignment with Crown Jewel Playbook controls (e.g., critical stakeholder inventory, supply chain risk management, risk assessments, data inventory, user access reviews).

• Project managing dependencies on other teams, such as timely Joiner‑Mover‑Leaver (JML) feeds from HR, and access reviews by Business Owners.

• Conduct risk assessments to identify, evaluate, and mitigate risks related to Salesforce data, processes, and integrations.

• Develop controls to ensure compliance with internal policies and external regulations.

• Ensure Salesforce configuration and operations comply with global and regional regulations (e.g., GDPR, SOX).

• Tightening RBAC structures by reviewing and documenting roles, permissions, and access controls, ensuring least privilege and periodic reviews.

• Collaborate with IT Security to design and enforce secure Salesforce configurations (SSO, MFA, RBAC, encryption).

• Ensure proper segregation of duties and implement internal controls within Salesforce.

• Oversee third‑party application and integration risk assessments.

• Preparing for and responding to cybersecurity incidents within Sales Enablement scope, driving internal innovation to define best practices for securing the domain.

• Mitigating cybersecurity risks generated by Sales Enablement activities, ensuring policies are applied and critical assets (Crown Jewels) are protected.

• Define audit‑ready processes and provide evidence of compliance for internal and external audits.

• Establish monitoring, logging, and reporting mechanisms for ongoing compliance validation.

• Ensuring SOX compliance by gathering timely evidence of control operation and proactively preparing audit responses.

• Measuring compliance with IT policies, setting KPIs, and initiating activities to close gaps, preparing submissions for audits and the Executive Risk Committee.

• Implement continuous improvement to address findings from audits and risk reviews.

• Act as a key liaison between compliance, security, business, and Salesforce program leadership.

• Provide guidance and training to Salesforce admins, developers, and business stakeholders on compliance best practices.

• Acting as the Digital Risk representative for the Domain interacting with other relevant GRC teams as required.

• Keep up‑to‑date with Salesforce releases, platform changes, and emerging…