To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts.

Job Category
Software Engineering

Job Details

About Salesforce

We're Salesforce, the Customer Company, inspiring the future of business with AI+ Data +CRM. Leading with our core values, we help companies across every industry blaze new trails and connect with customers in a whole new way. And, we empower you to be a Trailblazer, too - driving your performance and career growth, charting new paths, and improving the state of the world. If you believe in business as the greatest platform for change and in companies doing well and doing good - you've come to the right place.

• The Incident Response Analyst will respond to and investigate cyber security events within the SNS Cloud environments, track and document security events and incidents in a ticketing system, and analyze log data for signs of malicious activity in a Security Information and Event Manager (SIEM).
• The Analyst will need to work across multi-disciplined teams to coordinate incident response actions for high-priority, high-transparency operations security issues to drive toward a resolution while meeting required service-level agreements, escalating as appropriate, and providing regular updates to senior leaders.
• This position offers a challenging opportunity to be exposed to a diverse set of security disciplines, including incident response, forensics, reverse engineering, malware analysis, intrusion detection, network security, and system security.
• This position provides opportunities to automate workflows and processes, develop new analytics and apply mitigations for adversary Tactics, Techniques, and Procedures (TTPs), and hunt for undetected indicators of compromise.
• This position may require you to provide periods of 24x7 on-call support on an as-needed basis.
• As we work with Government customers, this position may require occasional local travel to customer sites.

• The candidate must be a U.S. citizen and must have an active U.S. Government Top Secret/SCI security clearance with Polygraph.
• A related technical degree, such as Computer Science, Software Engineering, Cybersecurity, Information Assurance, or equivalent work experience.
• 4+ years experience in cybersecurity, engineering, and/or incident response roles.
• Strong interpersonal and communication skills required for coordinating responses to sophisticated incidents across the organization with many non technical and technical stakeholders.
• Strong problem solving ability to determine solutions to encountered or anticipated challenges.
• Robust technical understanding of the information security threat landscape (attack vectors and tools, best practices for securing systems and networks, etc.).
• An in-depth understanding of TCP/IP network protocols and application layer protocols (e.g., HTTP, SMTP, DNS, etc.).
• Experience with one or more SIEMs, like Splunk, Azure Sentinel, ElasticStack, etc.

• Technical understanding of the information security threat landscape, to include attack vectors, tools, best practices for securing systems and networks, etc.
• Familiarity with incident response and security operations within cloud environments.
• Familiarity with Mac OSX, Microsoft Windows, and Linux/Unix system administration and security controls.
• Technical understanding of AWS, Azure, or GCP administration and security controls.
• Experience creating and managing event and metric dashboards with tools like Splunk, Kibana, Grafana, etc.
• Experience with data query languages, such as SQL, SPL, GraphQL, etc.
• Scripting language (i.e. Bash, Python, etc.) and workflow automation experience.
• Operational experience monitoring devices such as network and host-based intrusion detection systems, web application firewalls, database security monitoring systems, firewalls/routers/switches, proxy servers, antivirus systems, file integrity monitoring tools, and operating system logs.
• System forensics/investigation skills, including analyzing system artifacts (file system, memory, running processes, network connections) for indicators of infection/compromise.
• Relevant information security certifications, such as CISSP, GCFR, GCIA, GCIH or other related certifications.