Lead Incident Response Engineer

salesforce.com, inc.

McLean (VA)

On-site

USD 173,000 - 260,000

Full time

10 days ago

Application generator

Don’t send a generic resume — generate a resume and cover letter tailored to this exact role.

Get past ATS filters

Job summary

Salesforce is seeking a Senior Lead Incident Responder for the CSIRT team. You will own response to high-severity incidents, act as on-shift escalation, and drive automation and playbooks across on-prem and multi-cloud environments. This hands-on role emphasizes technical excellence over people management and requires 8+ years in information security.

Core hours are 10:30 AM - 6:30 PM ET, with on-call rotations including overnights and weekends as needed. U.S. citizenship is required.

Qualifications

8+ years in information security with hands-on operational monitoring and incident response.
Experience with host and network forensics across Windows, macOS and Linux.
Experience responding to incidents in cloud environments (AWS, Azure, GCP) including CI/CD pipelines and cloud logging/telemetry.
Strong understanding of threat landscape and MITRE ATT&CK.

Responsibilities

Lead end-to-end response to high-severity incidents, from initial triage through containment, eradication, recovery, and post-incident review.
Act as the technical escalation point and on-shift decision-maker for the incident response team.
Investigate sophisticated adversaries, insider threats, and web application attacks across on-premises and multi-cloud environments.
Design and build process improvements, playbooks, and automation (SOAR) to reduce time-to-detect and time-to-respond.