Threat Intelligence Automation Developer; Orchestration

Job Details

Job Category: Software Engineering

Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we’re looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce’s core values at the heart of it all.

Our Threat Intelligence team focuses on defending Salesforce and our customers by cutting through the noise and identifying who’s targeting us and what emerging threats we need to prepare for. Our team includes those who have faced nation‑state, eCrime, and other types of adversaries in threat intelligence, incident response, and/or threat detection functions in past lives. We use our wide expertise to drive direction, support investigations, and uplift security as a whole across Salesforce.

In the capacity of a Threat Intelligence Automation Developer, you operate at the nexus of security analysis and systems development within our Counter‑Threat Operations. Your objective is to convert massive streams of adversary data into meaningful insights by engineering and optimizing large‑scale automated pipelines. Beyond simply processing data, you will architect the essential framework that empowers our Threat Intelligence (TI), Security Operations Center (SOC), and Incident Response (IR) practitioners to outpace modern threats.

You will drive initiatives to expand our tracking of threat groups, analyze malicious campaigns, and streamline the delivery of intelligence across the entire security ecosystem.

Washington, D.C. | McLean, VA | Seattle, WA | San Francisco, CA

• Engineering and Systems Orchestration:
  Architect and implement programmatic solutions and cross‑platform integrations within the Threat Intelligence Platform (TIP) and Security Orchestration, Automation, and Response (SOAR) ecosystems to drive high‑velocity security operations at scale.
• Strategic
  
  Collaboration:
  
  Work alongside Threat Researchers to decode sophisticated adversary tradecraft, transforming manual investigative workflows into automated and repeatable detection frameworks.
• Collections Leadership:
  Function as a pivotal member of the Collections Team; oversee the evaluation of novel data streams and serve as the technical authority for sophisticated data ingestion and normalization initiatives.
• Intelligence Lifecycle Refinement:
  Optimize the intelligence production cycle by engineering automations that eliminate manual processing burdens, empowering practitioners to prioritize complex strategic analysis.
• Design and orchestrate complex systems where AI agents integrate seamlessly into human workflows, driving efficiency and innovation at scale.
• Contribute to building and maintaining the shared system context—an explicit repository of system designs, constraints, and standards that enables AI to operate accurately and reliably.

• A minimum of three years within the cybersecurity domain, including at least one year dedicated to security engineering, Dev Sec Ops , or automation workflows.
• Advanced Python development ability for complex programmatic requirements; additional proficiency in Bash and JavaScript for orchestration and frontend‑adjacent scripting is highly desirable.
• Hands‑on experience implementing SOAR platform orchestration utilizing industry‑standard tools such as Palo Alto Cortex XSOAR, Splunk Phantom, Tines, or Swimlane.
• Familiarity with the administration and expansion of Threat Intelligence Platforms, specifically including environments like Vertex Synapse, Threat Connect, Anomali, or MISP.
• Demonstrated expertise in normalizing unstructured data via RESTful APIs and regular expressions (Regex), with a focus on mapping digital footprints into structured formats like JSON or the Synapse Data Model.
• Technical mastery of version control systems, primarily git, and the integration of Continuous Integration/Continuous Delivery (CI/CD) best practices within security engineering workflows.
• Experien…