Senior Incident Responder, Global CSIRT

• Investigate and respond to security incidents end to end — triage, containment, eradication, recovery, and post-incident review — taking point on many incidents and supporting Lead Incident Responders on the highest-severity, highest-visibility events.
• Investigate adversary activity, insider threats, and web application attacks across on-premises and multi-cloud environments.
• Contribute to process improvements, playbooks, and automation — including Security Orchestration, Automation, and Response (SOAR) tooling and detection-as-code — that reduce time-to-detect and time-to-respond, and support strategic projects expanding detection and response capabilities.
• Produce clear incident documentation and status updates for technical and non-technical stakeholders, mentor newer incident responders, and support the team's on-call rotation (core hours 10:30 AM–6:30 PM ET, Monday–Friday, with occasional overnight/weekend on-call as needed).

You're Our Person If...

• You have 5+ years in information security, including hands-on operational security monitoring and incident response.
• You can perform host and network forensics across Windows, macOS, and Linux — analyzing file system, memory, process, and network artifacts for indicators of compromise — and have responded to incidents in cloud environments (AWS, Azure, and/or GCP), including familiarity with cloud architectures, CI/CD (continuous integration/continuous delivery) pipelines, and cloud logging/telemetry.
• You've handled high-priority incidents, including insider investigations, adversary activity, and web application attacks, and have a solid, current understanding of the threat landscape — attacker tactics, techniques, and procedures (TTPs), tooling, and hardening best practices — including working knowledge of a framework such as MITRE ATT&CK.
• You communicate clearly in writing and verbally, document incidents effectively, and build trusted relationships with peers inside and outside your team.

• You're developing depth in a specialty — malware analysis, detection engineering, forensics, cloud security, offensive security, or applied AI/ML for security.
• You have prior experience in a 24x7x365 security operations environment, and have improved team capability through automation and tool development.
• You hold relevant certifications: SANS GCIH, GCFA, GCFE, GNFA, GPEN, GREM, or Offensive Security OSCP.
• You have experience applying AI and LLMs to SOC operations — AI-powered tooling, LLM-assisted threat analysis, and AI-driven detection — and a strong understanding of the Salesforce platform and its SaaS offerings.