Information Security Architect - CSIRT

Overview

Core investigative role on Salesforce's CSIRT team, handling customer cybersecurity incidents from raw log data to a defensible account of what the threat actor did, what they accessed, and what was at risk.

What you'll do

• Lead analysis on investigations independently, taking multi-source datasets (Splunk, CrowdStrike Falcon Next-Gen SIEM (NG-SIEM), SQL) and reconstructing threat actor activity across varying Salesforce products.
• Adapt the investigative approach when standard playbook procedures don't map cleanly to the incident, documenting the deviation and rationale.
• Perform log analysis independently: multi-source joins, regex parsing, and hypothesis-driven pivoting across data sources.
• Scope advanced exfiltration patterns (Aura, GraphQL, Bulk API) on well-documented TTP types without senior guidance.
• Produce accurate, complete case documentation and investigation timelines, review your own case work end-to-end before submission, and contribute to customer-facing reports.
• Lead investigations into ATO, credential compromise, data exfiltration, and API abuse incidents; escalate genuinely novel or multi-cloud/complex cases to a Technical Lead.
• Execute containment actions independently (credential rotation, IP blocks, OAuth revocation); escalate strategic or platform-level actions for approval and stakeholder coordination.
• Interact directly with customers through the case management system and lead standard, non-hostile customer calls, explaining log data and findings to non-technical audiences.
• Prepare comms requests with enough technical detail for the comms team to act without follow-up.
• Proactively identify detection opportunities and gaps, partnering with Detection Engineering to tune existing coverage and raise net-new detection logic.
• Identify procedural gaps or friction during investigations, document updates to fix broken processes, and automate repetitive workflows.
• Complete AppExchange audits and ISV investigations without senior supervision on standard cases.
• Share knowledge with the team on a regular cadence through case walkthroughs, team presentations, or documentation contributions.
• Support AI-first initiatives by using and helping improve automated agents for triage, documentation, and investigation workflows.
• Build working relationships across ITM/SSRC (Detection, Product Security, Legal) to accelerate incident resolution.

What you'll need

• 5+ years in security incident response with consistent hands-on technical case work, currently performing active investigations rather than purely coordinating.
• Strong, independent analytical skill under pressure.
• Demonstrated ability to take multi-source data and produce a correct, defensible account of incidents without hand-holding.
• Proficient log analysis in Splunk, CrowdStrike Falcon Next-Gen SIEM (NG-SIEM), and SQL, including multi-source joins and regex parsing, performed independently with no more than peer review.
• Hands-on threat hunting: run hypothesis-driven hunts across large security datasets (NG-SIEM, Splunk) to surface malicious activity that isn't yet alerting, and pivot findings into an active investigation.
• Solid hands-on experience with Account Takeover, credential compromise, data exfiltration, and API abuse incidents.
• Proactive "raise the bar" mindset, with a track record of fixing inefficient processes, automating manual toil, and leaving workflows better than found.
• Strong technical knowledge across systems, networks, cloud security, and forensic techniques.
• Demonstrated composure and judgment across multiple concurrent investigations.
• Strong familiarity with Salesforce products/ecosystems, or comparable multi-tenant SaaS platforms.
• Ability to lead standard customer calls and communicate complex technical findings to non-technical audiences clearly.
• Working familiarity with regional and global compliance standards (GDPR, PCI-DSS, DORA).
• Ability to drive an investigation to a clear, defensible outcome and coordinate across functions.

Nice to have

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or a related technical field.
• Software development and/or detection engineering background, comfortable writing code or scripts to extend tooling, automate investigative tasks, build agentic workflows, or translate findings into detection logic.
• Prior experience operating within a large, global enterprise organization or high-scale SOC/IR environment.
• Salesforce Admin certified.
• Experience with forensic cases involving large or unusual datasets.
• Hands-on experience with AI/automation tooling in security operations (automated triage, detection tuning, agentic workflows).
• Certifications such as SANS GCIH, GCFA, GNFA, OSCP, or equivalent (or actively working toward one).
• Experience with cloud-native environments (AWS, GCP, Azure).
• Familiarity with Marketing Cloud and Commerce Cloud log analysis and incident patterns.

Details

• Location: India - Hyderabad.