Senior CSIRT Incident Response Lead & Automation

Salesforce; Bellevue (WA); On-site; USD 173,000 - 260,000; Full time

Job summary

Salesforce is seeking a Lead Incident Responder for the CSIRT to own high-severity incidents end-to-end. This hands-on role requires deep security operations expertise and the ability to influence incident response across the team.

Core hours are 10:30 AM – 6:30 PM ET, with on-call rotation including overnights and weekends as needed, and a focus on automation, playbooks, and detection‑as‑code to raise our security posture.

Qualifications

• 8+ years in information security with hands-on security monitoring and incident response experience.
• Host and network forensics across Windows, macOS, and Linux with IOC analysis.
• Experience responding to incidents in cloud environments (AWS, Azure, GCP) and familiarity with CI/CD pipelines.
• Strong understanding of attacker TTPs and framework knowledge (MITRE ATT&CK).

Responsibilities

• Lead end-to-end response to high-severity incidents from triage to post-incident review.
• Act as technical escalation point for the incident response team.
• Investigate adversaries, insider threats, and web app attacks across on-prem and multi-cloud environments.
• Design and build playbooks, automation, and SOAR tooling to reduce detection and response times.

Skills

Incident response

Cloud security

Digital forensics

SOAR tooling

Threat intelligence

Education

SANS GCIH

GCFA

OSCP

Tools

SOAR tooling

Job description

Salesforce is seeking a Lead Incident Responder for the CSIRT to own high-severity incidents end-to-end. This hands-on role requires deep security operations expertise and the ability to influence incident response across the team.

Core hours are 10:30 AM – 6:30 PM ET, with on-call rotation including overnights and weekends as needed, and a focus on automation, playbooks, and detection‑as‑code to raise our security posture.