Senior Global CSIRT Incident Responder

Salesforce; McLean (VA); On-site; USD 149,000 - 224,000; Full time

Job summary

Salesforce is seeking a Senior Incident Responder to join the CSIRT team in McLean, VA. You will investigate and respond to security incidents end to end, lead on high‑severity events, and help improve playbooks, detections, and automation.

This hands‑on role requires 5+ years in information security, cloud experience (AWS/Azure/GCP), and strong written and verbal communication. You will mentor junior analysts and support on‑call rotations.

Qualifications

• 5+ years in information security, including hands‑on operational security monitoring and incident response.
• Host and network forensics across Windows, macOS, Linux; cloud incidents; familiarity with cloud architectures, CI/CD pipelines, and cloud logging/telemetry.
• Experience with high‑priority incidents, insider investigations, web app attacks; solid understanding of attacker TTPs and hardening best practices.
• Clear written and verbal communication; ability to document incidents and build trusted relationships.

Responsibilities

• Investigate and respond to security incidents end to end — triage, containment, eradication, recovery, post‑incident review; lead on high‑severity events.
• Investigate adversary activity, insider threats, and web app attacks across on‑prem and multi‑cloud environments.
• Contribute to playbooks, automation, SOAR tooling, and detection‑as‑code to improve time‑to‑detect and time‑to‑respond.
• Document incidents for technical and non‑technical stakeholders, mentor newer responders, support on‑call rotation.

Skills

Incident response

Security monitoring

Cloud security

Forensics

MITRE ATT&CK

SOAR tooling

CI/CD

Tools

SOAR tooling

Cloud logging

AWS/Azure/GCP

Job description

Salesforce is seeking a Senior Incident Responder to join the CSIRT team in McLean, VA. You will investigate and respond to security incidents end to end, lead on high‑severity events, and help improve playbooks, detections, and automation.

This hands‑on role requires 5+ years in information security, cloud experience (AWS/Azure/GCP), and strong written and verbal communication. You will mentor junior analysts and support on‑call rotations.