Senior GovCloud CSIRT Lead — Incident Response

salesforce.com, inc.; Virginia (IL); On-site; USD 173,000 - 260,000; Full time

Job summary

Salesforce is seeking a Lead Incident Responder for the GovCloud CSIRT. The role requires protecting data across Salesforce environments with 24x7x365 security monitoring and rapid incident response, focusing on FedRAMP environments.

On-call work including evenings and weekends is required, with core hours 10:30 AM - 6:30 PM EST, Monday through Friday. This position sits within the AMERS CSIRT, supporting US GovCloud, with a strong emphasis on cross-functional collaboration, automation, and

Qualifications

• 8+ years of experience in information security and incident response.
• Strong system forensics and investigation skills across Windows, Mac OS X, and Linux.

Responsibilities

• Manage the response to high-severity security incidents and act as a technical escalation point for the Incident Responder team.
• Lead cross-functional response to high-priority security issues, including insider investigations, advanced adversaries, and web application attacks.
• Drive process improvement and automation for detection and incident response capabilities.
• Lead strategic projects that enhance detection and response capabilities within the environment.

Skills

Information security

Incident response

Forensics

Cloud security

Job description

Salesforce is seeking a Lead Incident Responder for the GovCloud CSIRT. The role requires protecting data across Salesforce environments with 24x7x365 security monitoring and rapid incident response, focusing on FedRAMP environments.

On-call work including evenings and weekends is required, with core hours 10:30 AM - 6:30 PM EST, Monday through Friday. This position sits within the AMERS CSIRT, supporting US GovCloud, with a strong emphasis on cross-functional collaboration, automation, and