Who is the CISO of Salesforce?

Iain Mulholland is the current Chief Information Security Officer (CISO) of Salesforce on CISO Tribune's record, appointed in the week of February 9, 2026.

How many security-leadership moves has CISO Tribune tracked at Salesforce?

CISO Tribune has tracked 1 move at Salesforce since February 9, 2026.

When was Iain Mulholland appointed at Salesforce?

Iain Mulholland's appointment as Chief Information Security Officer (CISO) of Salesforce was announced in the week of February 9, 2026, per SecurityWeek Industry Moves (week of 2026-02-09).

Where did Iain Mulholland work before becoming Chief Information Security Officer (CISO) of Salesforce?

The record of the appointment gives Iain Mulholland's previous role as Deputy CISO at Google Cloud.

Who are the security chiefs at other Technology organizations?

On CISO Tribune's record they include Brian Wilson at SAS, Raymond Winder at Sierra Orchestration, Ravi Soin at Smartsheet and Russ Gritzo at SMSI.

Who does the security chief of Salesforce report to?

Salesforce's fiscal 2026 Form 10-K, filed March 2, 2026, says its Chief Information Security Officer reports to the CITO.

Which board body oversees cybersecurity at Salesforce?

Salesforce's fiscal 2026 Form 10-K places oversight of cybersecurity risk with the Cybersecurity and Privacy committee.

Company record

Salesforce CISO: Iain Mulholland

The current Chief Information Security Officer (CISO) of Salesforce, as tracked by CISO Tribune, is Iain Mulholland, whose appointment was announced in the week of February 9, 2026 (SecurityWeek Industry Moves (week of 2026-02-09)). Previously Deputy CISO at Google Cloud. Read the record. The record entered the Wire on September 24, 2026.

Career profile: Iain Mulholland on CISO Spotlights ↗

What Salesforce tells the SEC

Its fiscal 2026 Form 10-K, filed March 2, 2026, carries an Item 1C cybersecurity disclosure that describes a Chief Information Security Officer reporting to the CITO, with oversight by the Cybersecurity and Privacy committee. Read the section verbatim or the filing on sec.gov. A filing describes governance as of its date, not today's seat.

Tracked by the Wire since February 9, 2026 · 1 recorded move · every claim links to a sourced record · Updated November 10, 2026

Where Salesforce appears on the record (3)

Every page on CISO Tribune and its network that carries this company, 3 in all.

On the Wire: Iain Mulholland named Chief Information Security Officer (CISO) at Salesforce · 2026-02-09
SEC filing: Form 10-K cybersecurity disclosure, fiscal 2026 · Item 1C, filed March 2, 2026
Career profile: Iain Mulholland on CISO Spotlights ↗

About Salesforce

CISO Tribune's Leadership Bench files Salesforce under Technology and North America. The SEC classifies it under standard industrial classification 7372, Services-prepackaged software, and EDGAR lists its ticker as CRM. The Wire has one security-leadership move at Salesforce on record, announced in the week of February 9, 2026.

What Salesforce's 10-K says about security governance

Salesforce's fiscal 2026 Form 10-K, filed March 2, 2026, describes its cybersecurity governance in Item 1C. The lines below are that filing's own statements, each with the sentence it comes from.

Reporting line: the Chief Information Security Officer reports to the CITO.
“The CITO, reporting to the Company's Chief Engineering & Customer Success Officer ("C/E"), together with the CISO, reporting to the CITO, are responsible for designing and implementing a security program and strategy based on the mandate provided by the Board and senior management.”
Board oversight: the Cybersecurity and Privacy committee.
“The Board, including through its dedicated Cybersecurity and Privacy committee (the "Committee"), oversees the various cybersecurity risks facing the Company and the Company's efforts to mitigate those risks.”
How often the board or committee hears about it: quarterly.
“After each quarterly meeting of the Committee, the Board receives a report from the Chair of the Committee with an update on the Company's oversight of cybersecurity risks and mitigation efforts.”
Frameworks and standards the filing names: ISO/IEC 27001, SOC 2 and NIST (publication not named).
Experience of the security leadership, as the filing states it:
“The CITO and CISO each have extensive experience in the management of cybersecurity risk programs, having served in various leadership roles in information technology and information security for over 20 years and 15 years, respectively.”
Material incidents: the filing states none.
“During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected the Company, including its business strategy, results of operations, or financial condition.”

Plain-English reading and full text of the filing · the filing on sec.gov

Security leadership timeline

2026-02-09

Iain Mulholland named Chief Information Security Officer (CISO) at Salesforce

Salesforce has named Iain Mulholland as its Chief Information Security Officer.

What Iain Mulholland has said in public

CISO Tribune's Voices section carries 2 public posts and talks by Iain Mulholland. The most recent are listed with their dates.

On agentic AI-driven attacks and emerging threat trends, LinkedIn, November 12, 2026.
On Salesforce platform security, LinkedIn, November 10, 2026.

Iain Mulholland's record

Security chiefs at other Technology organizations

Other organizations CISO Tribune files under Technology with a named security chief on record: those in North America first, in alphabetical order from Salesforce onward.

SAS: Brian Wilson, Chief Information Security Officer.
Sierra Orchestration: Raymond Winder, Chief Information Security Officer.
Smartsheet: Ravi Soin, Chief Information Security Officer.
SMSI: Russ Gritzo, Chief Information Security Officer.
Solana Foundation: Michael Coates, Chief Information Security Officer.
SolarWinds: Justin Henkel, Chief Information Security Officer.
Starburst: Paras Malhotra, Chief Information Security Officer.
Sumo Logic: Jeremy Powell, Chief Information Security Officer.

The full Technology bench

Questions CISOs ask about Salesforce

Who is the CISO of Salesforce?: Iain Mulholland is the current Chief Information Security Officer (CISO) of Salesforce on CISO Tribune's record, appointed in the week of February 9, 2026.
How many security-leadership moves has CISO Tribune tracked at Salesforce?: CISO Tribune has tracked 1 move at Salesforce since February 9, 2026.
When was Iain Mulholland appointed at Salesforce?: Iain Mulholland's appointment as Chief Information Security Officer (CISO) of Salesforce was announced in the week of February 9, 2026, per SecurityWeek Industry Moves (week of 2026-02-09).
Where did Iain Mulholland work before becoming Chief Information Security Officer (CISO) of Salesforce?: The record of the appointment gives Iain Mulholland's previous role as Deputy CISO at Google Cloud.
Who are the security chiefs at other Technology organizations?: On CISO Tribune's record they include Brian Wilson at SAS, Raymond Winder at Sierra Orchestration, Ravi Soin at Smartsheet and Russ Gritzo at SMSI.
Has Iain Mulholland spoken or written publicly?: CISO Tribune's Voices section carries 2 public posts and talks by Iain Mulholland, the most recent dated November 12, 2026.
Who does the security chief of Salesforce report to?: Salesforce's fiscal 2026 Form 10-K, filed March 2, 2026, says its Chief Information Security Officer reports to the CITO.
Which board body oversees cybersecurity at Salesforce?: Salesforce's fiscal 2026 Form 10-K places oversight of cybersecurity risk with the Cybersecurity and Privacy committee.

Related guides

CISO Reporting Structure, the Five Models and What the Filings Show
Most security chiefs report into technology leadership (64%), the rest to business leaders. The five models, their trade-offs and what 10-K filings show.
CISO News: Tracking Every Appointment and Departure in the Top Security Seat
CISO Tribune records every CISO appointment and departure as a sourced, dated entry, not a column: 466 moves to date, each with a primary source and a confirmed-or-reported label.
CISO, CSO, VP of Security, Head of Security: What the Titles Mean and What the Record Shows
A chief information security officer (CISO) owns information security. A chief security officer (CSO) usually adds physical security and investigations.