Senior Incident Responder, Global CSIRT — 24x7 Defense Lead

Salesforce; Bellevue (WA); On-site; USD 149,000 - 224,000; Full time

Job summary

Salesforce's CSIRT in Bellevue, WA seeks a Senior Incident Responder to lead end‑to‑end security incidents, mentor junior analysts, and improve playbooks. This hands‑on role focuses on detection, containment, eradication, and recovery across multi‑cloud environments.

You will triage incidents, coordinate with stakeholders, produce clear incident reports, and contribute to automation and SOAR tooling to shorten response times.

Qualifications

• 5+ years in information security with hands-on incident response.
• Experience with Windows/macOS/Linux forensics and cloud incidents (AWS/Azure/GCP).
• Familiarity with security frameworks and incident documentation practices.

Responsibilities

• Investigate and respond to security incidents end to end — triage, containment, eradication, recovery, and post‑incident review.
• Investigate adversary activity, insider threats, and web application attacks across on‑premises and multi‑cloud environments.
• Contribute to process improvements, playbooks, and automation — including SOAR tooling and detection‑as‑code.
• Produce clear incident documentation and status updates for technical and non‑technical stakeholders, mentor newer incident responders.

Skills

Information security

Incident response

Cloud security

Forensics

MITRE ATT&CK

Written communication

Tools

SOAR tooling

Cloud logging

CI/CD pipelines

Job description

Salesforce's CSIRT in Bellevue, WA seeks a Senior Incident Responder to lead end‑to‑end security incidents, mentor junior analysts, and improve playbooks. This hands‑on role focuses on detection, containment, eradication, and recovery across multi‑cloud environments.

You will triage incidents, coordinate with stakeholders, produce clear incident reports, and contribute to automation and SOAR tooling to shorten response times.