Senior Incident Response Lead — Complex Investigations

salesforce.com, inc.; Seattle (WA); On-site; USD 173,000 - 260,000; Full time

Benefits offered by this job

Medical

Dental

Vision

Mental health support

Paid parental leave

Life and disability insurance

401(k)

Employee stock purchasing program

Job summary

Salesforce is seeking a senior security investigator to own the most analytical parts of major investigations. You will reconstruct actor activity from multi-source data, lead investigations, and develop durable timelines and CAN reports to withstand legal scrutiny.

Ideal candidates have 8+ years in incident response, expert log analysis with Splunk/SQL, and deep knowledge of cloud security and SaaS ecosystems. The role involves cross-functional collaboration and direct customer communication.

Qualifications

• 8+ years in security incident response with hands-on investigations.
• Ability to take large, messy, multi-source data and produce a defensible account of what happened.
• Expert log analysis with Splunk/SQL and multi-source joins.

Responsibilities

• Reconstruct actor activity from multi-source data and logs.
• Lead investigations into major incidents across Salesforce Core, Marketing Cloud, and Commerce Cloud.
• Develop accurate, defensible investigation timelines and CAN reports.

Skills

Analytical mindset

Leadership

Communication

Compliance knowledge

SaaS familiarity

Tools

Splunk

SQL

Job description

Salesforce is seeking a senior security investigator to own the most analytical parts of major investigations. You will reconstruct actor activity from multi-source data, lead investigations, and develop durable timelines and CAN reports to withstand legal scrutiny.

Ideal candidates have 8+ years in incident response, expert log analysis with Splunk/SQL, and deep knowledge of cloud security and SaaS ecosystems. The role involves cross-functional collaboration and direct customer communication.