Senior Incident Response Lead

Salesforce; Virginia (MN); On-site; USD 140,000 - 190,000; Full time

Job summary

Salesforce's CSIRT team seeks a Lead Incident Responder to own high-severity incidents from triage through containment, eradication, and recovery.

You will be the on‑shift technical escalation point, mentor responders, and drive automation and playbooks to shorten time‑to‑detect and time‑to‑respond across multi‑cloud environments. This is a hands-on, senior technical role with significant influence and no direct people management.

Qualifications

• 8+ years in information security with hands-on incident response experience.
• Experience performing host and network forensics across Windows, macOS, Linux.
• Proficient in cloud environments (AWS, Azure, GCP) with cloud logging/telemetry.
• Working knowledge of MITRE ATT&CK framework.

Responsibilities

• Lead end-to-end response to high-severity incidents from triage to containment, eradication, and recovery.
• Act as the technical escalation point and on-shift decision-maker for the incident response team.
• Investigate sophisticated adversaries, insider threats, and web application attacks across on-premises and multi-cloud environments.
• Design and build process improvements, playbooks, and automation (SOAR, detection-as-code) to reduce time-to-detect and time-to-respond.

Skills

Incident Response

Forensics (Host/Network)

Cloud Security

MITRE ATT&CK

Tools

SOAR

Scripting

Job description

Salesforce's CSIRT team seeks a Lead Incident Responder to own high-severity incidents from triage through containment, eradication, and recovery.

You will be the on‑shift technical escalation point, mentor responders, and drive automation and playbooks to shorten time‑to‑detect and time‑to‑respond across multi‑cloud environments. This is a hands-on, senior technical role with significant influence and no direct people management.