Senior Global CSIRT Incident Response Lead

salesforce.com, inc.; Bellevue (WA); On-site; USD 149,000 - 224,000; Full time

Job summary

Salesforce is seeking an experienced Senior Incident Responder to join the CSIRT team, addressing 24x7 security operations across cloud and on-premises environments. You will lead investigations, develop playbooks, and mentor junior responders while coordinating with stakeholders.

Candidates should bring 5+ years in information security, strong forensics skills, and familiarity with MITRE ATT&CK. This role requires US citizenship and the ability to operate within Salesforce’s security framework

Qualifications

• 5+ years in information security and incident response.
• Experience with host and network forensics across Windows, macOS, and Linux.
• Familiarity with MITRE ATT&CK and cloud architectures.
• Ability to document incidents clearly for technical and non-technical stakeholders.

Responsibilities

• Investigate and respond to security incidents end to end - triage, containment, eradication, recovery, and post-incident review.
• Investigate adversary activity, insider threats, and web application attacks across on-premises and multi-cloud environments.
• Contribute to process improvements, playbooks, and automation - including SOAR tooling and detection-as-code.
• Produce clear incident documentation and status updates for technical and non-technical stakeholders, mentor newer incident responders, and support the on-call rotation.

Skills

Incident response

Information security

Cloud security

Forensics

Security monitoring

Communication

Tools

SOAR tooling

Cloud logging/telemetry

AWS/Azure/GCP

Job description

Salesforce is seeking an experienced Senior Incident Responder to join the CSIRT team, addressing 24x7 security operations across cloud and on-premises environments. You will lead investigations, develop playbooks, and mentor junior responders while coordinating with stakeholders.

Candidates should bring 5+ years in information security, strong forensics skills, and familiarity with MITRE ATT&CK. This role requires US citizenship and the ability to operate within Salesforce’s security framework