Principal Insider Threat Analyst

Overview of the Role

We are seeking a Principal Insider Threat Analyst to take a leading role in maturing our Insider Threat Program. This hands‑on technical position combines deep investigative expertise with the strategic vision to shape how the program operates over time.

• Be Salesforce’s subject matter expert in insider threat.
• Conduct investigations into the most complex and sensitive insider‑threat matters across all of Salesforce, owning the entire investigation from signal to handoff.
• Architect proactive threat‑hunting operations for insiders and translate the results into investigations and high‑fidelity detections.
• Evolve and maintain the model for a world‑class insider threat analysis program, identifying tooling, coverage gaps, metrics, and investment priorities while building and maintaining processes and playbooks.
• Contribute to risk assessments for crown jewel analysis, high‑sensitivity roles, and M&A activity.
• Drive cross‑functional alignment through building and maintaining relationships with partners across Salesforce.

• 12+ years experience in cybersecurity, incident response, intelligence, insider threat, or counterintelligence, with at least 5+ years leading and managing insider threat and/or counterintelligence investigations.
• Deep knowledge of procedures and indicators of malicious insider threat activity such as fraud, theft, sabotage, espionage, etc.
• Ability to identify and build new capabilities or processes as scaling needs arise.
• Demonstrated experience creating and employing effective strategies at scale.
• Strong verbal and written communication skills; ability to communicate effectively and clearly to executive leadership.
• Ability to build strong relationships with peers both internal and external to your functional group, and with peers/professional organizations outside the company.
• Related technical degree required.

• Experience building or maturing a formal Insider Threat Program (InTP) from the ground up, including developing playbooks, detection frameworks, and cross‑functional governance models – ideally in a corporate or government environment.
• Prior experience identifying and investigating insider threats within a cloud‑based software or platform organization, with familiarity in the unique data access patterns, privileged user risks, and IP theft vectors common to SaaS/PaaS companies.

If you need a reasonable accommodation during the application or the recruiting process, please submit a request via this Accommodations Request Form.

Salesforce is an equal‑opportunity employer and maintains a policy of non‑discrimination with all employees and applicants for employment. Employees, applicants, and prospective employees are assessed on the basis of merit, competence, and qualifications without regard to race, religion, color, national origin, sex, sexual orientation, gender expression or identity, transgender status, age, disability, veteran or marital status, political viewpoint, or other classifications protected by law.

In the United States, compensation offered will be determined by factors such as location, job level, job‑related knowledge, skills, and experience. Certain roles may be eligible for incentive compensation, equity, and benefits. Salesforce offers a variety of benefits to help you live well, including time off programs, medical, dental, vision, mental health support, paid parental leave, life and disability insurance, 401(k), and an employee stock purchasing program.

The typical base salary range for this position is $197,300 – $313,700 annually. In select cities within the San Francisco and New York City metropolitan area, the base salary range for this role is $237,700 – $344,700 annually. The range represents base salary only and does not include company bonus, incentive for sales roles, equity, or benefits, as applicable.