Lead GovCloud CSIRT — Incident Response Leader

salesforce.com, inc.

Washington (District of Columbia)

On-site

USD 173,000 - 260,000

Full time

6 days ago

Be an early applicant

Get more replies from employers

Send a job-specific resume in minutes.

Job summary

Salesforce is seeking a Lead Incident Responder for our GovCloud CSIRT. The role focuses on FedRAMP environments, acting as the last line of defense protecting company and customer data from adversaries. This position sits within the AMERS CSIRT, supporting US GovCloud.

On-call work including evenings and weekends is required; core hours are 10:30 AM - 6:30 PM EST, Monday through Friday. You will lead cross-functional response, drive automation, and participate in strategic projects to enhance

Qualifications

8+ years of experience in information security, including operational security monitoring and incident response.
System forensics and investigation skills across Windows, Mac OS X, and Linux with indicators of compromise.
Strong understanding of threat landscape, attack vectors, and best practices for securing systems and networks.

Responsibilities

Manage the response to high-severity security incidents and act as a technical escalation point for the Incident Responder team.
Lead cross-functional response to high-priority security issues, including insider investigations and web attacks.
Drive automation and process improvements for detection and incident response capabilities.
Lead strategic projects to enhance detection and response within the GovCloud environment.