Senior Lead Incident Responder

What you'll do

• Reconstruct threat actor actions by analyzing large, multi-source datasets including Splunk, SQL, and API logs.
• Perform expert log analysis using complex joins, regex parsing, and custom correlation under time pressure.
• Build accurate, defensible investigation timelines and reports that meet legal and regulatory scrutiny.
• Lead investigations into high-impact incidents such as account takeovers, data exfiltration, and API abuse.
• Execute strategic containment actions including credential rotation, IP blocks, and OAuth revocations.
• Lead hostile customer calls to communicate complex technical findings to legal counsel and regulatory bodies.
• Engineer new detections for identified TTPs and turn analysis findings into durable detection coverage.
• Review case work and provide structured feedback to mentor junior responders on advanced analysis techniques.

What we're looking for

• 8+ years in security incident response with consistent hands-on technical case work.
• Demonstrated ability to independently produce a correct, defensible account of events from large, messy, multi-source datasets.
• Expert log analysis skills in Splunk and SQL, including complex multi-source joins, regex parsing, and custom correlation.
• Expertise handling Account Takeover, credential compromise, data exfiltration, API abuse, and connected app exploitation incidents.
• Deep technical knowledge in systems, networks, cloud security, and forensic techniques.
• Strong familiarity with Salesforce products or comparable multi-tenant SaaS platforms.
• Ability to lead customer calls and communicate complex technical findings clearly to non-technical audiences.
• Strong understanding of regional and global compliance standards such as GDPR, PCI-DSS, and DORA.
• Salesforce Admin certified (preferred).
• 3–5 years in a lead or senior IR role within a large, global organization (preferred).
• Experience with complex forensic cases involving large datasets or unusual data sources (preferred).
• Hands-on experience with AI/automation tooling in security operations (preferred).
• Advanced certifications such as SANS GCFA, GNFA, GCIH, OSCP, or equivalent (preferred).
• Experience with e-commerce security or cloud-native environments like AWS, GCP, or Azure (preferred).
• Familiarity with Marketing Cloud and Commerce Cloud log analysis and incident patterns (preferred).