Lead Incident Responder: Drive 24x7 Security and Automation

salesforce.com, inc.; Bellevue (WA); On-site; USD 173,000 - 260,000; Full time

Job summary

Salesforce is seeking a Lead Incident Responder for the CSIRT team to own responses to the most severe security incidents. You will serve as the senior technical escalation point and drive improvements across detection, response, and automation in multi-cloud environments.

This hands-on, non-management role requires 8+ years in information security, with a strong focus on incident response, forensics, and cloud security.

Qualifications

• 8+ years in information security with hands-on security monitoring and incident response experience.
• Experience in host and network forensics across Windows, macOS, and Linux.
• Experience responding to incidents in cloud environments (AWS, Azure, and/or GCP).
• Deep understanding of attacker TTPs and system/network hardening; knowledge of MITRE ATT&CK.

Responsibilities

• Lead end-to-end response to high-severity, high-visibility incidents from triage to recovery and post-incident review.
• Act as the technical escalation point and on-shift decision-maker for the IR team.
• Investigate sophisticated adversaries and threats across on-premises and multi-cloud environments.
• Design and build process improvements, playbooks, and automation to reduce time-to-detect and time-to-respond.

Skills

Incident response

Cloud security

Forensics

Threat hunting

Incident management

Tools

SOAR

MITRE ATT&CK

Job description

Salesforce is seeking a Lead Incident Responder for the CSIRT team to own responses to the most severe security incidents. You will serve as the senior technical escalation point and drive improvements across detection, response, and automation in multi-cloud environments.

This hands-on, non-management role requires 8+ years in information security, with a strong focus on incident response, forensics, and cloud security.