Salesforce appoints Miguel Milano, its chief revenue officer, as COO; Chief Operating and Financial Officer Robin Washington will keep her title (Jordan Novet/CNBC)

Salesforce has split its operational leadership in a way that is rare for large SaaS providers. Milano’s promotion from revenue chief to COO suggests a deliberate tilt toward growth and customer-facing execution. For engineers, this likely means feature requests tied to revenue, such as AI-driven upsell tools or faster onboarding flows, will receive more internal advocacy. The trade-off is that infrastructure or security initiatives may face longer approval cycles if they lack a clear commercial narrative.

The retention of Washington as chief operating and financial officer creates a structural tension. Her continued presence implies that cost control, compliance, and capital efficiency remain priorities. Engineers should expect tighter scrutiny on cloud spend, third-party integrations, and any project that increases operational overhead. The dual-title arrangement also risks slowing consensus on cross-functional decisions, particularly in areas like platform security where revenue and compliance objectives often conflict.

Milano’s background at Oracle, a company known for aggressive sales tactics, may signal a shift in how Salesforce measures success. Teams building on the platform should prepare for increased pressure to demonstrate direct business impact, even for foundational work like API stability or data residency controls. The change does not remove Washington’s influence, so engineers will need to navigate competing incentives between growth and governance.

The absence of any mention of security in the announcement is notable. While the COO role typically oversees operational risk, Milano’s revenue-centric history suggests that security may become a secondary consideration unless it directly affects deal closure. Engineers responsible for compliance or incident response should anticipate a higher burden of proof to justify investments in proactive measures like zero-trust architecture or automated threat detection.