Senior Incident Response Lead - Advanced IR Analytics

Salesforce; Washington; On-site; USD 180,000 - 250,000; Full time

Job summary

Salesforce is seeking an experienced security incident responder to own high‑impact investigations. You will analyze large, multi‑source data sets, reconstruct attacker activity, and determine what was touched and at risk.

You will lead complex cases, coordinate containment actions, and communicate findings to legal and executive teams. You will work with Threat Intelligence, Detection Engineering, and Legal to improve detection coverage and incident response workflows, mentoring junior

Qualifications

• 8+ years in security incident response with hands-on investigations
• Expert log analysis—Splunk/SQL with multi-source joins and regex parsing
• Experience handling Account Takeover, credential compromise, data exfiltration, API abuse, and connected app exploitation

Responsibilities

• Own the analytical hardest part of major investigations: reconstruct multi-source activity and risk.
• Serve as the go-to analyst for complex, ambiguous cases.
• Perform expert log analysis: complex joins, regex parsing, and hypothesis-driven pivoting.
• Build accurate investigation timelines and defensive CAN reports for legal/regulatory scrutiny.
• Lead investigations into high-impact incidents across Salesforce Core, Marketing Cloud, and Commerce Cloud.
• Coordinate containment actions with stakeholders and leadership.
• Lead customer calls with legal/regulatory pressure and communicate findings clearly.

Skills

IR experience

Advanced log analysis

Splunk

SQL

Threat hunting

Forensic techniques

Stakeholder comms

Leadership

Tools

Splunk

SQL

Regex parsing

Data correlation

Job description

Salesforce is seeking an experienced security incident responder to own high‑impact investigations. You will analyze large, multi‑source data sets, reconstruct attacker activity, and determine what was touched and at risk.

You will lead complex cases, coordinate containment actions, and communicate findings to legal and executive teams. You will work with Threat Intelligence, Detection Engineering, and Legal to improve detection coverage and incident response workflows, mentoring junior