Salesforce
Senior Incident Responder, Global CSIRT
$148K–$224K
Virginia - Mclean +1 · Office Tech-Flexible · Senior · Full-time · Posted Sep 4, 2026
- Location
- Virginia - Mclean
Washington - Bellevue - Experience
- 5+ years in information security.
- Visa sponsorship
- Must be a U.S. citizen (U.S. born or naturalized), must not hold dual citizenship, and must agree to complete a U.S. federal government Minimum Background Investigation (MBI) for a Moderate Public Trust position.
About the job
Investigates and leads security incident response across Salesforce environments, while improving detections, playbooks, and automation and mentoring newer responders.
What you'll do
- Handle incidents end to end, including triage, containment, eradication, recovery, and post-incident review; lead many incidents and support response to the most severe events.
- Investigate adversary activity, insider threats, and web application attacks across on-premises and multi-cloud environments.
- Improve response processes, playbooks, detections, and automation; document incidents, mentor newer responders, and support the on-call rotation.
What they ask for
- 5+ years in information security, including hands-on operational security monitoring and incident response.
- Host and network forensics across Windows, macOS, and Linux, and incident response in cloud environments (AWS, Azure, and/or GCP).
- Experience handling high-priority incidents, including insider investigations, adversary activity, and web application attacks; working knowledge of a framework such as MITRE ATT&CK.
- Clear written and verbal communication and effective incident documentation.
Nice to have
- Specialty depth in areas such as malware analysis, detection engineering, forensics, cloud security, offensive security, or applied AI/ML for security; 24x7x365 security operations experience and automation/tool development.
- Relevant certifications (SANS GCIH, GCFA, GCFE, GNFA, GPEN, GREM, or Offensive Security OSCP); experience applying AI and LLMs to SOC operations.
Pay
$148,500 - $223,900 USD annually (base salary)
Tools
Windows, macOS, Linux, AWS, Azure, GCP, MITRE ATT&CK, SOAR
AI focus
Preferred experience applying AI and LLMs to SOC operations, including AI-powered tooling, LLM-assisted threat analysis, and AI-driven detection; applied AI/ML for security is a potential specialty.
Model-written summary · the original posting is authoritative