Senior CSIRT Incident Responder - Global 24/7 Security

Salesforce; Virginia (MN); On-site; USD 150,000 - 190,000; Full time

Job summary

Salesforce's CSIRT is a 24x7x365 security operations team safeguarding data across all environments. We seek a Senior Incident Responder to investigate incidents end to end, lead high-severity cases, and mentor newer analysts.

This hands-on role focuses on incident response, playbook improvements, and automation using SOAR. On-call rotation includes core hours 10:30 AM-6:30 PM ET, with occasional overnight/weekend shifts.

Qualifications

• 5+ years in information security with hands-on incident response.
• Experience in host and network forensics across Windows, macOS, Linux.
• Familiarity with cloud architectures, CI/CD, and cloud logging/telemetry.
• Proven ability to lead incidents and mentor junior analysts.

Responsibilities

• Investigate and respond to security incidents end to end – triage, containment, eradication, recovery, post-incident review.
• Triage adversary activity, insider threats, and web app attacks across on-prem and multi-cloud.
• Contribute to playbooks, detections, and automation using SOAR and incident tooling.
• Produce clear incident documentation and support on-call rotation (core hours 10:30 AM-6:30 PM ET, Mon-Fri).

Skills

Information security

Incident response

Forensics

Cloud security

Automation & SOAR

Threat analysis

Communication

Education

SANS GCIH

GCFA

GCFE

GNFA

GPEN

GREM

OSCP

Tools

AWS

Azure

GCP

CI/CD pipelines

SOAR tooling

Job description

Salesforce's CSIRT is a 24x7x365 security operations team safeguarding data across all environments. We seek a Senior Incident Responder to investigate incidents end to end, lead high-severity cases, and mentor newer analysts.

This hands-on role focuses on incident response, playbook improvements, and automation using SOAR. On-call rotation includes core hours 10:30 AM-6:30 PM ET, with occasional overnight/weekend shifts.