Senior Incident Responder, Global CSIRT
Spotted 4d agoFull time
What you'll need to apply
Fields this application requires
NameEmailPhoneCountryRésuméWork authorization answerVisa sponsorship answer
Company-specific questions
- Do you have the unrestricted right to work in the country to which you're applying? (You must answer “No” if you are on any visa or possess any government issued work authorization document that has an expiration date; you should answer “Yes” if you have DACA or TPS authorization in the US)
- Government Employment: In the last 5 years, have you been an employee of a U.S. federal, state, or local government, including a "special Government employee" (defined under 18 U.S.C. §202), or a member of the U.S. Armed Services (including Reserve and Guard components)?
- I attest/confirm that I have no post-government employment restrictions currently applicable to me that have not already been addressed or disclosed in the previous questions, OR that if I am aware of any applicable restrictions, I will disclose them to the recruiter if contacted for further processing of my application. If I received written advice from my current or former government employer about work restrictions that are still active, I will provide it to the recruiter if contacted for further processing of my application.
- Are you currently or have you in the past been debarred, suspended, proposed for debarment or declared ineligible for award of a contract by any federal agency?
- As a U.S. company that exports software and technology internationally, we must comply with U.S. export control laws in every country where we operate. The information provided will be used to determine whether we need to obtain an Export Control License for your employment if you are hired. Are you a citizen, national or permanent resident of Iran, Cuba, North Korea or Syria?
- Regarding future positions at Salesforce, please select one of the following options
- I acknowledge that I have read, reviewed and answered the above questions truthfully and accurately. I further understand, and agree, that any offer of employment I may receive from Salesforce is conditional on the truth of the above statements and that, in the event it is subsequently determined that any of the above is inaccurate, any such offer of employment can be rescinded and, in the event I have commenced employment, such employment will be terminated, to the extent permitted by applicable law. Please select "yes" if you acknowledge.
Job description
About this role
Employer-provided description, formatted for easier reading.
The Experience
Salesforce's Computer Security Incident Response Team (CSIRT) provides 24x7x365 security monitoring and rapid incident response across every Salesforce environment, protecting company and customer data from adversaries.
As a Senior Incident Responder, you'll be a core member of the response team — investigating and handling security incidents end to end, taking a lead role on many of them, and escalating to Lead Incident Responders on the most severe or ambiguous events. You'll also help improve the playbooks, detections, and automation that make the team faster, and mentor newer analysts as you grow toward a lead role yourself.
This is a hands-on technical role focused on the detailed work of incident response.
What You'll Actually Be Doing
- Investigate and respond to security incidents end to end — triage, containment, eradication, recovery, and post-incident review — taking point on many incidents and supporting Lead Incident Responders on the highest-severity, highest-visibility events.
- Investigate adversary activity, insider threats, and web application attacks across on-premises and multi-cloud environments.
- Contribute to process improvements, playbooks, and automation — including Security Orchestration, Automation, and Response (SOAR) tooling and detection-as-code — that reduce time-to-detect and time-to-respond, and support strategic projects expanding detection and response capabilities.
- Produce clear incident documentation and status updates for technical and non-technical stakeholders, mentor newer incident responders, and support the team's on-call rotation (core hours 10:30 AM–6:30 PM ET, Monday–Friday, with occasional overnight/weekend on-call as needed).
You're Our Person If...
- You have 5+ years in information security, including hands-on operational security monitoring and incident response.
- You can perform host and network forensics across Windows, macOS, and Linux — analyzing file system, memory, process, and network artifacts for indicators of compromise — and have responded to incidents in cloud environments (AWS, Azure, and/or GCP), including familiarity with cloud architectures, CI/CD (continuous integration/continuous delivery) pipelines, and cloud logging/telemetry.
- You've handled high-priority incidents, including insider investigations, adversary activity, and web application attacks, and have a solid, current understanding of the threat landscape — attacker tactics, techniques, and procedures (TTPs), tooling, and hardening best practices — including working knowledge of a framework such as MITRE ATT&CK.
- You communicate clearly in writing and verbally, document incidents effectively, and build trusted relationships with peers inside and outside your team.
Even Better If...
- You're developing depth in a specialty — malware analysis, detection engineering, forensics, cloud security, offensive security, or applied AI/ML for security.
- You have prior experience in a 24x7x365 security operations environment, and have improved team capability through automation and tool development.
- You hold relevant certifications: SANS GCIH, GCFA, GCFE, GNFA, GPEN, GREM, or Offensive Security OSCP.
- You have experience applying AI and LLMs to SOC operations — AI-powered tooling, LLM-assisted threat analysis, and AI-driven detection — and a strong understanding of the Salesforce platform and its SaaS offerings.
Interested in this role?Continue on Salesforce's careers page.
Apply on Salesforce