Global CSIRT Senior Incident Responder — Lead Incident Response

Enboarder; McLean (VA); Sur place; USD 120 000 - 180 000; Plein temps

Résumé du poste

Salesforce's CSIRT provides 24x7x365 security monitoring and rapid incident response across every Salesforce environment, protecting company and customer data from adversaries. As a Senior Incident Responder, you'll lead investigations, handle incidents end to end, and escalate to Lead Incident Responders on severe events.

This hands-on role focuses on incident response and mentoring, with opportunities to improve playbooks and automation.

Qualifications

• 5+ years in information security, with hands-on security monitoring and incident response.
• Experience performing host and network forensics across Windows, macOS, and Linux.
• Responded to incidents in cloud environments (AWS, Azure, or GCP) with knowledge of cloud architectures and telemetry.
• Familiarity with MITRE ATT&CK framework and threat landscape.

Responsabilités

• Investigate and respond to security incidents end to end—triage, containment, eradication, recovery, and post-incident review.
• Investigate adversary activity, insider threats, and web application attacks across on-premises and multi-cloud environments.
• Contribute to process improvements, playbooks, and automation (SOAR tooling) to reduce detection and response times.
• Produce clear incident documentation and status updates for technical and non-technical stakeholders.

Connaissances

Incident response

Cloud forensics

MITRE ATT&CK

Threat detection

Communication

Outils

SOAR

Forensics tools

Description du poste

Salesforce's CSIRT provides 24x7x365 security monitoring and rapid incident response across every Salesforce environment, protecting company and customer data from adversaries. As a Senior Incident Responder, you'll lead investigations, handle incidents end to end, and escalate to Lead Incident Responders on severe events.

This hands-on role focuses on incident response and mentoring, with opportunities to improve playbooks and automation.