Senior Lead Incident Responder

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts.

Job Category

Job Details

About Salesforce

Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all.

Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce.

The Experience:

This is CREST's analysis anchor. The primary job is investigation — but specifically the hard analytical core of it: taking a messy, high-volume, multi-source pile of log data and figuring out what actually happened, what the threat actor touched, and what was truly at risk. We're hiring for analytical horsepower first. The right person is someone who is genuinely a killer in analysis — they see the pattern in the noise faster than anyone in the room, build a defensible timeline from incomplete evidence, and can prove what happened rather than guess at it. Operational coordination and customer work are part of the role, but they sit on top of a foundation of elite investigative analysis. If you're an investigator who runs to the data, this role is built for you.
 

What You'll Actually Be Doing:

• Own the analytical hardest-part of major investigations — take large, messy, multi-source datasets (Splunk, SQL, UIP/MonC, API/login/export logs) and reconstruct exactly what the threat actor did, what they accessed, and what was at risk.
• Serve as the team's go-to analyst on complex or ambiguous cases — the person others bring a stalled investigation to when the data isn't giving up its answer easily.
• Perform expert log analysis independently: complex multi-source joins, regex parsing, custom correlation, and hypothesis-driven pivoting across data sources under time pressure.
• Build accurate, complete, and defensible investigation timelines and CAN reports — analysis that holds up to legal and regulatory scrutiny.
• Lead investigations into advanced or high-impact incidents across Salesforce Core, Marketing Cloud, and Commerce Cloud — ATO, credential compromise, data exfiltration, API abuse, connected app exploitation.
• Approve and execute strategic containment actions (credential rotation, IP blocks, OAuth revocation, escalated platform actions) with appropriate stakeholder coordination.
• Lead hostile and contentious customer calls, including those with legal counsel or regulatory pressure, and communicate complex technical findings clearly.
• Engineer net-new detections for newly identified TTPs; turn what you find in analysis into durable detection coverage with Detection Engineering.
• Raise the analytical bar on the team — review Grade 6/7 case work, give structured written feedback on investigative rigor, and mentor junior responders on advanced analysis technique.
• Support CREST's AI-first initiatives — use and help improve automated agents for triage, documentation, and investigation workflows.
• Collaborate with Threat Intelligence, Detection Engineering, and Legal on incident handling and cross-functional initiatives.

You're Our Person If You Have:

• 8+ years in security incident response with consistent hands-on technical case work; currently performing investigations, not purely managing or coordinating.
• Demonstrated ability to take large, messy, multi-source data and independently produce a correct, defensible account of what happened. We will weight this above every other qualification.
• Expert log analysis — Splunk/SQL including complex multi-source joins, regex parsing, and custom correlation — performed independently, fast, without assistance.
• Expertise handling Account Takeover, credential compromise, data exfiltration, API abuse, and connected app exploitation incidents.
• Deep technical knowledge in systems, networks, cloud security, and forensic techniques.
• Demonstrated composure and judgment across multiple concurrent high-pressure investigations.
• Strong familiarity with Salesforce products/ecosystems, or comparable multi-tenant SaaS platforms.
• Ability to lead customer calls and communicate complex technical findings to non-technical audiences clearly and confidently.
• Strong understanding of regional and global compliance standards (GDPR, PCI-DSS, DORA).
• Proven ability to lead cross-functional investigations and deliver clear, defensible outcomes.

Even Better If You Have:

• Salesforce Admin certified.
• 3–5 years in a lead or senior IR role within a large, global organization.
• Experience with complex forensic cases involving large datasets or unusual/novel data sources — the harder the data, the better.
• Hands-on experience with AI/automation tooling in security operations (automated triage, detection tuning, agentic workflows).
• Advanced certifications (SANS GCFA, GNFA, GCIH, OSCP, or equivalent).
• Experience with e-commerce security or cloud-native environments (AWS, GCP, Azure).
• Familiarity with Marketing Cloud and Commerce Cloud log analysis and incident patterns.

Unleash Your Potential

When you join Salesforce, you’ll be limitless in all areas of your life. Our benefits and resources support you to find balance and be your best, and our AI agents accelerate your impact so you can do your best. Together, we’ll bring the power of Agentforce to organizations of all sizes and deliver amazing experiences that customers love. Apply today to not only shape the future — but to redefine what’s possible — for yourself, for AI, and the world.

Accommodations

If you need a reasonable accommodation during the application or the recruiting process, please submit a request via this Accommodations Request Form.

Please note that Salesforce uses artificial intelligence (AI) tools to help our recruiters assess and evaluate candidates’ resumes and qualifications throughout the recruiting process. Humans will always make any candidate selection and hiring decisions. Please see our Candidate Privacy Statement for more information about how we use your personal data and your rights, including with regard to use of AI tools and opt out options.

Posting Statement

Salesforce is an equal opportunity employer and maintains a policy of non-discrimination with all employees and applicants for employment. What does that mean exactly? It means that at Salesforce, we believe in equality for all. And we believe we can lead the path to equality in part by creating a workplace that’s inclusive, and free from discrimination. Know your rights: workplace discrimination is illegal. Any employee or potential employee will be assessed on the basis of merit, competence and qualifications – without regard to race, religion, color, national origin, sex, sexual orientation, gender expression or identity, transgender status, age, disability, veteran or marital status, political viewpoint, or other classifications protected by law. This policy applies to current and prospective employees, no matter where they are in their Salesforce employment journey. It also applies to recruiting, hiring, job assignment, compensation, promotion, benefits, training, assessment of job performance, discipline, termination, and everything in between. Recruiting, hiring, and promotion decisions at Salesforce are fair and based on merit. The same goes for compensation, benefits, promotions, transfers, reduction in workforce, recall, training, and education.