Computer Security Incident Report Analyst TS​/SCI Clearance Salesforce National Security

Computer Security Incident Response Analyst

Location: On‑site in Northern Virginia. The position is not remote.

Salesforce seeks an Incident Response Analyst for the Government Cloud Security Operations team, part of the Salesforce National Security Infrastructure Security Team. The analyst will work on the front line of environments supporting U.S. Government agencies and departments, providing 24×7×365 security monitoring, real‑time analysis of security alerts, and rapid incident response across SNS Cloud environments.

Key Responsibilities:

• Respond to and investigate cyber security events within SNS Cloud environments.
• Track and document security events and incidents in a ticketing system.
• Analyze log data for signs of malicious activity in a SIEM.
• Coordinate incident response actions across multi‑disciplined teams for high‑priority operations, meeting service‑level agreements, escalating as needed, and providing updates to senior leaders.
• Automate workflows and processes, develop new analytics, apply mitigations for adversary TTPs, and hunt for undetected indicators of compromise.
• Provide periods of 24×7 on‑call support on an as‑needed basis and occasional local travel to customer sites.

Minimum Qualifications:

• U.S. citizen with an active U.S. Government Top Secret/SCI clearance with Polygraph.
• A related technical degree (Computer Science, Software Engineering, Cybersecurity, Information Assurance) or equivalent experience.
• At least 2 years of experience in cybersecurity, engineering, or incident response roles.
• Strong interpersonal and communication skills for coordinating responses across technical and non‑technical stakeholders.
• Strong problem‑solving ability.
• Technical understanding of the information security threat landscape, including attack vectors and tools.
• Experience with AWS Cloud, Splunk, Azure Sentinel, or Elastic Stack preferred.

Desired

Skills:

• Deep knowledge of TCP/IP and application layer protocols (HTTP, SMTP, DNS).
• Familiarity with incident response and security operations in cloud environments.
• Experience with Mac OSX, Windows, and Linux/Unix system administration and security controls.
• Competence in AWS, Azure, or GCP administration and security controls.
• Experience creating and managing dashboards with Splunk, Kibana, Grafana, etc.
• Knowledge of query languages such as SQL, SPL, GraphQL.
• Proficiency in scripting (Bash, Python) and workflow automation.
• Operational experience with intrusion detection systems, web application firewalls, database security monitoring, firewalls, proxies, antivirus, file integrity monitoring, and OS logs.
• Forensic skills for analyzing system artifacts (file system, memory, processes, network connections).
• Relevant certifications (CISSP, GCFR, GCIA, GCIH or related).

Benefits: Salesforce offers medical, dental, vision, mental health support, paid parental leave, life and disability insurance, 401(k), employee stock purchase program, and time‑off programs.

Compensation: Typical base salary range: $111,000 – $122,000 annually.

Salesforce is an equal‑opportunity employer and maintains a policy of non‑discrimination for all employees and applicants. All employment decisions are made on merit without regard to race, religion, color, national origin, sex, sexual orientation, gender identity, disability, veteran status, or other protected classifications.