Information Security Architect - CSIRT

Start free →

Or apply yourself on the official page →

About the role

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts. Job Category Enterprise Technology & Infrastructure Job Details About Salesforce Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all. Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce. Role Summary This is a core investigative role on the team responsible for handling customer cybersecurity incidents — offering a unique opportunity to fight threat actors at scale. The job is investigation: driving incidents from raw log data to a defensible account of what actually happened, what the threat actor touched, and what was at risk. We want a strong, independent analyst — someone who runs to the data, builds a solid timeline from imperfect evidence, and doesn't need a senior sitting next to them to get to the answer on a well-understood incident. We are looking for people who raise the bar — if you see a broken process, you fix it; if you encounter a repetitive task, you automate it. The right person is comfortable veering from the documented playbook when an incident's attributes don't fit it — and disciplined enough to document why. Operational coordination and customer work sit on top of that investigative foundation. If you want to be right in the middle of the action fighting threat actors at scale, this is where you want to be. If you can own an investigation end-to-end and know when a case is genuinely novel enough to pull in help, this role is built for you. Responsibilities • Lead the analysis on investigations independently — take multi-source datasets (Splunk, CrowdStrike Falcon Next-Gen SIEM (NG-SIEM), SQL) and reconstruct what the threat actor did, what they accessed, and what was at risk, across varying Salesforce products. • Adapt the investigative approach when standard playbook procedures don't map cleanly to the incident — document the deviation and the rationale rather than working around it silently. • Perform log analysis independently: multi-source joins, regex parsing, and hypothesis-driven pivoting across data sources — needing no assistance beyond peer review. • Scope advanced exfiltration patterns (Aura, GraphQL, Bulk API) on well-documented TTP types without requiring senior guidance. • Produce accurate, complete case documentation and investigation timelines; review your own case work end-to-end before submission, catching gaps proactively rather than relying on peer review — and contribute to customer-facing reports. • Lead investigations into ATO, credential compromise, data exfiltration, and API abuse incidents; escalate genuinely novel or multi-cloud/complex cases to a Technical Lead. • Execute containment actions independently (credential rotation, IP blocks, OAuth revocation); escalate strategic or platform-level actions (deployment moratoriums, platform cuts) for approval and appropriate stakeholder coordination. • Interact directly with customers through our case management system and lead standard, non-hostile customer calls — explaining log data and delivering complex technical findings clearly to non-technical audiences without requiring a senior team member on the call. • Prepare comms requests with enough technical detail that the comms t

View the official posting →