Senior Global Incident Responder

salesforce.com, inc.; McLean (VA); On-site; USD 149,000 - 224,000; Full time

Job summary

Salesforce's CSIRT team seeks an experienced security incident responder to champion 24x7 monitoring and rapid response across Salesforce environments. You will handle end-to-end investigations, triage and containment, and support cloud security initiatives with automation and detection tooling.

You will collaborate with cross-functional teams, maintain incident documentation, and participate in on-call rotations.

Qualifications

• 5+ years in information security with hands-on operational monitoring and incident response
• Experience with host and network forensics across Windows, macOS, Linux; familiarity with cloud architectures and CI/CD pipelines
• Knowledge of threat landscape, attacker TTPs, and MITRE ATT&CK framework; strong written and verbal communication

Responsibilities

• Investigate and respond to security incidents end to end including triage, containment, eradication, and post-incident reviews
• Investigate adversary activity, insider threats, and web app attacks across on-prem and multi-cloud environments
• Contribute to playbooks, automation, SOAR tooling, and detection-as-code to reduce time-to-detect/respond
• Produce incident documentation and status updates for tech and non-technical stakeholders; support on-call rotations (core hours 10:30 AM-6:30 PM ET)

Skills

information security

incident response

forensics

cloud security

communication

ATT&CK

MITRE ATT&CK

Education

SANS GCIH

GCFA

GCFE

GNFA

GPEN

GREM

OSCP

Tools

AWS

Azure

GCP

SOAR tooling

Job description

Salesforce's CSIRT team seeks an experienced security incident responder to champion 24x7 monitoring and rapid response across Salesforce environments. You will handle end-to-end investigations, triage and containment, and support cloud security initiatives with automation and detection tooling.

You will collaborate with cross-functional teams, maintain incident documentation, and participate in on-call rotations.