Description
Salesforce is seeking a Senior Incident Responder to join its Computer Security Incident Response Team (CSIRT). The successful candidate will investigate and handle security incidents end-to-end, taking a lead role on many incidents and escalating to Lead Incident Responders on the most severe or ambiguous events.
Responsibilities:
- Investigate and respond to security incidents end-to-end , triage, containment, eradication, recovery, and post-incident review
- Investigate adversary activity, insider threats, and web application attacks across on-premises and multi-cloud environments
- Contribute to process improvements, playbooks, and automation , including Security Orchestration, Automation, and Response (SOAR) tooling and detection-as-code
- Produce clear incident documentation and status updates for technical and non-technical stakeholders
- Mentor newer incident responders and support the team's on-call rotation
Requirements:
- 5+ years in information security, including hands-on operational security monitoring and incident response
- Ability to perform host and network forensics across Windows, macOS, and Linux
- Experience responding to incidents in cloud environments (AWS, Azure, and/or GCP)
- Solid understanding of the threat landscape , attacker tactics, techniques, and procedures (TTPs), tooling, and hardening best practices
- Excellent communication and documentation skills
Nice to Have:
- Prior experience in a 24x7x365 security operations environment
- Relevant certifications: SANS GCIH, GCFA, GCFE, GNFA, GPEN, GREM, or Offensive Security OSCP
- Experience applying AI and LLMs to SOC operations
- Strong understanding of the Salesforce platform and its SaaS offerings