Salesforce

Senior Lead Incident Responder

Salesforce • $172K — $260K *
Washington, DC 20011In-Person
Information Technology
8 - 10 years of experience
Today
Be an Early Applicant
Job Overview by Ladders

Qualifications

  • 8+ years in security incident response with hands-on case work.
  • Expert log analysis skills in Splunk/SQL and complex data sourcing.
  • Proven ability to analyze high-volume log data and produce accurate reports.
  • Deep understanding of API abuse, data exfiltration, and account compromise.
  • Strong familiarity with Salesforce products or similar multi-tenant SaaS solutions.
  • Experience leading high-pressure investigations and customer communications.
  • Knowledge of compliance standards like GDPR and PCI-DSS.

Responsibilities

  • Own major investigations involving complex multi-source datasets.
  • Lead as the primary analyst for challenging cases not yielding immediate answers.
  • Perform independent expert log analysis under time pressure.
  • Build defensible investigation timelines and reports for legal scrutiny.
  • Coordinate strategic containment actions with stakeholders during incidents.
  • Communicate complex findings clearly to customers, including legal teams.
  • Collaborate with cross-functional teams on incident handling and proactive initiatives.

Benefits

  • Flexible working environment.
  • Opportunities for continuous learning and skill development.
  • Collaborative culture with a focus on mentorship and team elevation.
  • Involvement in cutting-edge AI initiatives in security.
  • Exposure to high-impact incidents across diverse areas.
Full Job Description
To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts.

Job Category
Enterprise Technology & Infrastructure

Job Details

The Experience:

This is CREST's analysis anchor. The primary job is investigation - but specifically the hard analytical core of it: taking a messy, high-volume, multi-source pile of log data and figuring out what actually happened, what the threat actor touched, and what was truly at risk. We're hiring for analytical horsepower first. The right person is someone who is genuinely a killer in analysis - they see the pattern in the noise faster than anyone in the room, build a defensible timeline from incomplete evidence, and can prove what happened rather than guess at it. Operational coordination and customer work are part of the role, but they sit on top of a foundation of elite investigative analysis. If you're an investigator who runs to the data, this role is built for you.

What You'll Actually Be Doing:
  • Own the analytical hardest-part of major investigations - take large, messy, multi-source datasets (Splunk, SQL, UIP/MonC, API/login/export logs) and reconstruct exactly what the threat actor did, what they accessed, and what was at risk.
  • Serve as the team's go-to analyst on complex or ambiguous cases - the person others bring a stalled investigation to when the data isn't giving up its answer easily.
  • Perform expert log analysis independently: complex multi-source joins, regex parsing, custom correlation, and hypothesis-driven pivoting across data sources under time pressure.
  • Build accurate, complete, and defensible investigation timelines and CAN reports - analysis that holds up to legal and regulatory scrutiny.
  • Lead investigations into advanced or high-impact incidents across Salesforce Core, Marketing Cloud, and Commerce Cloud - ATO, credential compromise, data exfiltration, API abuse, connected app exploitation.
  • Approve and execute strategic containment actions (credential rotation, IP blocks, OAuth revocation, escalated platform actions) with appropriate stakeholder coordination.
  • Lead hostile and contentious customer calls, including those with legal counsel or regulatory pressure, and communicate complex technical findings clearly.
  • Engineer net-new detections for newly identified TTPs; turn what you find in analysis into durable detection coverage with Detection Engineering.
  • Raise the analytical bar on the team - review Grade 6/7 case work, give structured written feedback on investigative rigor, and mentor junior responders on advanced analysis technique.
  • Support CREST's AI-first initiatives - use and help improve automated agents for triage, documentation, and investigation workflows.
  • Collaborate with Threat Intelligence, Detection Engineering, and Legal on incident handling and cross-functional initiatives.


You're Our Person If You Have:
  • 8+ years in security incident response with consistent hands-on technical case work; currently performing investigations, not purely managing or coordinating.
  • Demonstrated ability to take large, messy, multi-source data and independently produce a correct, defensible account of what happened. We will weight this above every other qualification.
  • Expert log analysis - Splunk/SQL including complex multi-source joins, regex parsing, and custom correlation - performed independently, fast, without assistance.
  • Expertise handling Account Takeover, credential compromise, data exfiltration, API abuse, and connected app exploitation incidents.
  • Deep technical knowledge in systems, networks, cloud security, and forensic techniques.
  • Demonstrated composure and judgment across multiple concurrent high-pressure investigations.
  • Strong familiarity with Salesforce products/ecosystems, or comparable multi-tenant SaaS platforms.
  • Ability to lead customer calls and communicate complex technical findings to non-technical audiences clearly and confidently.
  • Strong understanding of regional and global compliance standards (GDPR, PCI-DSS, DORA).
  • Proven ability to lead cross-functional investigations and deliver clear, defensible outcomes.


Even Better If You Have:
  • Salesforce Admin certified.
  • 3-5 years in a lead or senior IR role within a large, global organization.
  • Experience with complex forensic cases involving large datasets or unusual/novel data sources - the harder the data, the better.
  • Hands-on experience with AI/automation tooling in security operations (automated triage, detection tuning, agentic workflows).
  • Advanced certifications (SANS GCFA, GNFA, GCIH, OSCP, or equivalent).
  • Experience with e-commerce security or cloud-native environments (AWS, GCP, Azure).
  • Familiarity with Marketing Cloud and Commerce Cloud log analysis and incident patterns.

About Salesforce

ExactTarget is a provider of on-demand email marketing software solutions. Their suite of on-demand one-to-one marketing applications enables clients to send business-critical and event-triggered communications to increase sales, optimize marketing investments, and strengthen customer relationships. They offer four editions of their on-demand software application along with integrated solutions such as ExactTarget for AppExchange and ExactTarget for [Microsoft](/organization/Microsoft) Dynamics CRM.

Salesforce Careers

Joining Salesforce means becoming part of a dynamic, global team of professionals who are deeply committed to driving customer success and innovation. As the world's leading Customer Relationship Management (CRM) platform, Salesforce offers unparalleled job opportunities in technology and consulting, making it an ideal place for ambitious individuals looking to make a significant impact.

Work You'll Do

At Salesforce, every position is a chance to leverage your skills and creativity to transform businesses and industries. Our diverse team of experts collaborates to deliver cutting-edge solutions that foster growth and enhance leadership capabilities. By joining our team, you'll be at the forefront of digital innovation, using Salesforce's powerful platform to help clients navigate their transformation journeys.

Innovate and Lead

Salesforce is not just a company; it's a community where you can lead with your ideas and see them come to life. Our culture of innovation encourages you to challenge the status quo and push the boundaries of what's possible. With Salesforce, you'll work alongside leaders in technology and business who are committed to your growth and professional development.

Career Growth and Opportunities

Whether you're looking for an internship, a full-time position, or leadership roles, Salesforce provides a wealth of opportunities to advance your career. Our commitment to professional growth is reflected in our robust training programs, including leadership development and diversity training, designed to help you excel at every stage of your career.

Be Part of a Great Team

Salesforce prides itself on a culture that values diversity, teamwork, and open communication. We believe that our strength lies in our people, and we're committed to creating an environment where everyone can thrive. Joining our team means being part of a supportive community that encourages networking and collaboration.

Benefits and Culture

At Salesforce, we understand that job satisfaction extends beyond the office. That's why we offer competitive benefits to support the health, well-being, and financial security of our employees and their families. From health insurance and retirement plans to wellness programs and flexible working arrangements, we provide the benefits that contribute to a better work-life balance.

Explore Job Opportunities

Ready to take the next step in your career? Explore the wide range of employment opportunities at Salesforce. From technical roles to customer engagement positions, we are continuously hiring talented individuals who are passionate about making a difference.

Stay Connected

Keep up to date with the latest at Salesforce by following our careers blog. Gain insights from the people who work here and learn how you can bring your career to the next level with Salesforce.

Apply Now

Are you ready to join a company that's leading the way in CRM technology? Search open positions that match your skills and interests on our careers page. Tailor your resume, prepare for your interview, and take the first step towards a rewarding career at Salesforce.

SEARCH SALESFORCE JOBS

Join Salesforce today and be part of a company that's shaping the future of technology, fostering a culture of innovation, and building a more equitable world.
Learn more about Salesforce
Size
73,541 employees
Market Cap
$130.4 billion
Industry
Enterprise Technology
Net Income
$4 billion
Founded
2000
5 Year Trend
+25.7%
Revenue
$21.2 billion
NASDAQ
CRM
* Ladders Estimates

Similar Jobs

Ad banner background

Get Ready For Your
Next Interview

More Jobs at Salesforce

More Information Technology Jobs

Find similar Senior Lead Incident Responder jobs:

NationwideWashington, DC