Associate Incident Responder - CSIRT

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts. Job Category Enterprise Technology & Infrastructure Job Details About Salesforce Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all. Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce. Salesforce - the leader in enterprise cloud computing - is seeking a Security Analyst in our Cyber Security Incident Response Team (CSIRT). Candidates must have a passion for Information Security and a firm understanding of security monitoring and incident response. Salesforce has one of the best Information Security teams in the world and growing this piece of the business is a top priority! Our Information Security teams work hand in hand with the business to ensure the highest security around all of our applications and infrastructure. CSIRT is a geographically distributed team, responsible for 24x7x365 security monitoring and rapid incident response across all Salesforce environments. We are the ‘tip of the spear’ protecting company and customer data from our adversaries. As a key member of our growing Global CSIRT, the Associate Security Analyst is on the ‘front lines’ of the Salesforce production environment; You will be contributing to CSIRT projects, conducting threat hunts and improving core CSIRT workflows and processes. Working hours correspond to our “follow the sun” operating model and shift according to daylight savings during the year. Applicants must meet all visa requirements to work and live in Australia   REQUIRED SKILLS: Minimum 1 year of prior specialised security operations experience consisting of: Flexibility, drive, integrity, and creative problem-solving skills Operational experience with Endpoint Detection and Response (EDR) solutions i.e. Crowdstrike etc. Operational experience with log analysis platforms i.e. Splunk, Google Security Operations, Kibana etc. The ability to build strong relationships with peers both internal and external to your functional group, and with peers/professional organisations outside your company Strong verbal and written communication skills; ability to communicate effectively and clearly to both technical and non-technical audiences Familiarity with core concepts of security incident response, e.g., the typical phases of response, vulnerabilities vs threats vs actors, Indicators of Compromise (IoCs), etc. Understanding of network fundamentals and common Internet protocols, specifically DNS, HTTP, HTTPS/TLS, and SMTP Understanding of cloud security principles and experience with public cloud (e.g. AWS, Azure, or GCP) Understanding of Mac OSX, Microsoft Windows, and Linux/Unix system administration and security control fundamentals Strong interest in information security, including awareness of current threats and security best practices Knowledge of email security threats and security controls, including analyzing email headers Understanding of AI-driven security threats and proficiency in using AI tools for security analysis and task automation DESIRED SKILLS: Understanding of the information security threat landscape (attack vectors and tools, best practices for securing systems and networks, etc.) Previous experience of collaborating with global teams Working proficiency with programming /scripting languages is a plus: i.e. Python, Bash, Go, PowerShell Relevant information security certifications, such as: BTL1, SAL1,