Senior Lead Incident Responder

What you'll do

• Analyze large, multi-source datasets from Splunk, SQL, and APIs to reconstruct threat actor activities and identify what was at risk.
• Perform complex log analysis using regex parsing, custom correlation, and hypothesis-driven pivoting under time pressure.
• Build defensible investigation timelines and CAN reports that meet legal and regulatory scrutiny.
• Lead investigations into high-impact incidents including account takeovers, data exfiltration, and API abuse across Salesforce platforms.
• Execute strategic containment actions such as credential rotations, IP blocks, and OAuth revocations.
• Lead technical calls with customers and legal counsel to communicate complex findings clearly.
• Engineer new detections for identified TTPs by collaborating with the Detection Engineering team.
• Mentor junior responders and provide structured feedback on investigation quality and analytical rigor.

What we're looking for

• 8+ years of experience in security incident response with consistent hands-on technical case work.
• Demonstrated ability to independently analyze large, multi-source datasets to produce defensible investigation accounts.
• Expert log analysis skills using Splunk and SQL, including complex joins, regex parsing, and custom correlation.
• Expertise handling account takeover, credential compromise, data exfiltration, API abuse, and connected app exploitation.
• Deep technical knowledge in systems, networks, cloud security, and forensic techniques.
• Strong familiarity with Salesforce products or comparable multi-tenant SaaS platforms.
• Ability to lead customer calls and communicate complex technical findings clearly to non-technical audiences.
• Knowledge of global compliance standards such as GDPR, PCI-DSS, and DORA.
• Salesforce Admin certification (preferred).
• 3–5 years in a lead or senior IR role within a large, global organization (preferred).
• Experience with complex forensic cases involving large datasets or unusual data sources (preferred).
• Hands-on experience with AI/automation tooling in security operations (preferred).
• Advanced certifications such as SANS GCFA, GNFA, GCIH, OSCP, or equivalent (preferred).
• Experience with e-commerce security or cloud-native environments like AWS, GCP, or Azure (preferred).