Lead Incident Responder, CSIRT

🔥 0 minutes ago

⚔️ Virginia – Remote

⚔️ Virginia – Remote

💵 $172.5k - $260.1k / year

⏰ Full Time

🟠 Senior

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Salesforce

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 1999

💼 Consulting

📣 Marketing

☁️ SaaS

Consulting • Marketing • SaaS

Salesforce is a leading cloud-based software company that provides a comprehensive customer relationship management (CRM) platform. The platform connects all company data and teams on an integrated, AI-driven system to improve sales, customer service, and marketing efforts. Salesforce offers scalable solutions for businesses of all sizes, including small and medium enterprises, and provides industry-specific solutions to modernize operations, save time, and reduce costs. Salesforce also offers educational resources through Trailhead and a wide selection of apps on AppExchange to extend its CRM capabilities.

📋 Description

• Manage responses to high-severity security incidents • Act as a technical escalation point for the Incident Responder team • Lead cross-functional responses to high-priority, high-visibility security issues, including insider investigations, advanced adversaries, and web application attacks • Drive process improvement and automation for detection and incident response capabilities • Lead strategic projects that enhance detection and response capabilities within the US GovCloud environment • Support the GovCloud CSIRT's 24x7x365 security monitoring and rapid incident response • Participate in on-call work, including evenings and weekends, as needed • Work core hours of 10:30 AM–6:30 PM EST, Monday through Friday

🎯 Requirements

• 8+ years of experience in information security, including operational security monitoring and incident response • System forensics and investigation skills across Windows, Mac OS X, and Linux • Experience analyzing file system, memory, running processes, and network connection artifacts for indicators of compromise • Strong technical understanding of the information security threat landscape, including attack vectors, tools, and best practices for securing systems and networks • Clear and effective verbal and written communication with executive leadership • U.S. citizenship (U.S. born or naturalized) • Must not hold dual citizenship • Agreement to complete a U.S. federal government Minimum Background Investigation (MBI) for a Moderate Public Trust position • Subject matter expertise in malware analysis, detection writing, forensics, cloud security, or offensive security is an advantage • Experience responding to security incidents in AWS, Microsoft Azure, or Google Cloud is an advantage • Familiarity with cloud architectures, CI/CD, and logging is an advantage • Prior experience in a 24x7x365 operations environment is an advantage • Experience driving automation and capability uplift through tool development, artificial intelligence, or SOAR platforms is an advantage • Relevant information security certifications such as SANS GCIH, SANS GPEN, SANS GFCA, or Offensive Security OSCP are an advantage

🏖️ Benefits

• Time off programs • Medical insurance • Dental insurance • Vision insurance • Mental health support • Paid parental leave • Life insurance • Disability insurance • 401(k) • Employee stock purchasing program • Incentive compensation may be available for certain roles • Equity may be available for certain roles