Lead Incident Responder, GovCloud CSIRT

Salesforce, Inc.; Washington (Washington County); On-site; USD 173,000 - 260,000; Full time

Job summary

Salesforce, Inc. is seeking a Lead Incident Responder for the GovCloud CSIRT to deliver 24x7x365 security monitoring and rapid incident response across Salesforce GovCloud environments.

You’ll act as a technical escalation point and drive cross-functional responses to high-priority threats while advancing detection and automation. The role requires 8+ years in information security, strong forensics across Windows, Mac OS X, and Linux, and the ability to communicate with executives.

Qualifications

• 8+ years of experience in information security, including operational security monitoring and incident response.
• System forensics across Windows, Mac OS X, and Linux with analysis of artifacts for indicators of compromise.
• Strong technical understanding of the information security threat landscape, attack vectors, tools, and best practices.
• Clear and effective communication with executive leadership, verbally and in writing.
• Subject matter expert in malware analysis, detection writing, forensics, cloud security, or offensive security.
• Experience in 24x7x365 operations and automation/SOAR implementations.
• Relevant information security certifications (GCIH, GPEN, GFCA, OSCP).

Responsibilities

• Manage the response to high-severity security incidents and act as a technical escalation point for the Incident Responder team.
• Lead cross-functional response to high-priority security issues, including insider investigations and web application attacks.
• Drive process improvement and automation for detection and incident response capabilities.
• Lead strategic projects that enhance detection and response within the environment.

Skills

Incident response

Information security

Forensics

Threat landscape understanding

Executive communication

Education

Information security certifications (GCIH/GPEN/GFCA/OSCP)

Tools

Windows

Mac OS X

Linux

SOAR

CI/CD

Cloud security (AWS/Azure/Google Cloud)

Job description

Salesforce, Inc. is seeking a Lead Incident Responder for the GovCloud CSIRT to deliver 24x7x365 security monitoring and rapid incident response across Salesforce GovCloud environments.

You’ll act as a technical escalation point and drive cross-functional responses to high-priority threats while advancing detection and automation. The role requires 8+ years in information security, strong forensics across Windows, Mac OS X, and Linux, and the ability to communicate with executives.