Senior Lead Incident Responder - Advanced IR Analytics

Salesforce; Seattle (WA); On-site; USD 173,000 - 260,000; Full time

Job summary

Salesforce is seeking an experienced security incident responder to drive complex investigations across core platforms and cloud ecosystems. You will reconstruct attack narratives from multi-source data, lead engagements with legal and regulatory teams, and coordinate containment actions with stakeholders.

The role requires hands-on IR expertise, strong log analysis skills, and the ability to deliver clear, defensible outcomes under pressure.

Qualifications

• Experience in security incident response with hands-on case work.
• Ability to take large, multi-source data and produce defensible outcomes.
• Strong log analysis using Splunk/SQL and regex parsing.

Responsibilities

• Reconstruct what the threat actor did from multi-source data.
• Lead investigations across Salesforce Core, Marketing Cloud and Commerce Cloud.
• Approve and execute containment actions with stakeholders.
• Lead calls with legal/regulatory during incidents.
• Develop detections to cover new TTPs.

Skills

8+ years in security IR

Expert log analysis

Account takeover incidents

Lead investigations

Communicate to non-technical audiences

Compliance knowledge (GDPR/PCI-DSS/D L

Education

Salesforce Admin certified

Tools

AI/automation tooling in SO

Job description

Salesforce is seeking an experienced security incident responder to drive complex investigations across core platforms and cloud ecosystems. You will reconstruct attack narratives from multi-source data, lead engagements with legal and regulatory teams, and coordinate containment actions with stakeholders.

The role requires hands-on IR expertise, strong log analysis skills, and the ability to deliver clear, defensible outcomes under pressure.