CSIRT Incident Manager

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts.

Job Category

Products and Technology

Job Details

Salesforce - the leader in enterprise cloud computing and one of the top 10 places to work according to Fortune magazine -is seeking an Incident Manager for our Computer Security Incident Response Team (CSIRT) with a passion for Information Security and ability to perform Incident Response at an enterprise scale.

The Computer Security Incident Response Team (CSIRT) at Salesforce deals with the most challenging problems in information security. When you're first reading about a new issue in the news, our CSIRT is already working on it! The pace and variety of our work creates a unique learning environment. You’ll be given unique challenges and the tools to solve them, surrounded by amazing colleagues, and supported by incredibly helpful partner teams.

The Incident Manager is responsible for leading the company’s response to high severity incidents. Successful Incident Managers thrive on challenge, are calm under pressure, and can think on their feet. Specifically, the Incident Manager is responsible for:

• Ensure flawless execution of the incident resolution process, with transparent communication that drives very high levels of internal/external customer satisfaction 

• Creation, communication, and execution of incident response strategy and actions for individual security incidents.

• Manages resources assigned to the incident and ensures the incident is receiving the proper support to drive resolution as quickly as possible.

• Escalating, prioritizing, communicating, and coordinating high severity incidents ensuring adherence to the company’s incident response process.

• Represents Security as the initial single on-point contact for any confirmed or potential high severity incidents and ensures interested parties and executives are alerted via an internal executive facing chatter group.

• Addresses incoming escalations from executives regarding the incident.

• Ensure all agreed to operational policies and procedures are adhered to and championing the incident response process.

• Driving the incident response process from detection through containment and eradication. 

• Lead the coordination with internal stakeholders through resolution of the incident. Closely partnering and collaborating with Infrastructure, Engineering, Operations, Technical Support, Customer Success and Sales Leadership to ensure alignment across the business.

• Leading cross-functional post-incident process reviews to ensure continuous improvement of operations and execution­

• Contribute to the improvement of the incident response process based on lessons learned. 

• Train and mentor staff on the incident response process.

This position is based in Sydney, Australia or Remote APAC (for the right candidate). This role generally works a standard business week, but occasional weekend work and/or on-call rotations may be required.

Required Skills:

• 5+ years experience in the Information Security field, including operational security monitoring or incident response experience.

• 3+ years managing, coordinating, and ensuring resolution of security issues.

• Deep experience leading and responding to complex critical incidents related to security, availability, or customer experience incidents.

• Ability to manage and constantly triage multiple security incidents, differentiating urgent issues from the merely important.

• Ability to stand back from a complex problem, logically assess the facts and formulate a plan of action - even in the worst of situations.

• Strong technical knowledge of complex systems, ideally in a multi-tenant, Cloud environment

• Strong technical understanding of network fundamentals and common Internet protocols.

• Strong technical understanding of the information security threat landscape (attack vectors and tools, best practices for securing systems and networks, etc.).

• Must have strong verbal and written communication skills; ability to communicate effectively and clearly to both technical and non-technical staff.

• Excellent customer relations skills with experience working with teams across multiple time zones.

• Strong teamwork skills with the ability to build and grow relationships with incident response stakeholders. 

• Excellent project management skills, including demonstrated ability to manage projects across teams where influencing skills are required.

• Executes with a high level of operational urgency.

• Flexibility, integrity and creative problem-solving skills are a prerequisite to be successful in this role.

• Prior experience in a 24x7x365 operations environment.

Desired Skills:

• Strong operational and services experience in a cloud services delivery environment

• Experience in conducting root cause analysis.

• Experience in using the IT Incident Command (IC) and/or IT Incident Management System (IMS) frameworks.

• Broad information security knowledge, including some familiarity with key regulations and standards relating to security incident response (e.g., PCI-DSS, GDPR, ISO 27001).

• Windows, Mac and Linux forensics/investigation skills.

• Relevant information security certifications, such SANS GCIA, GCIH, GCFA, GNFA, GDAT, GPCS or similar industry certifications. 

#LI-

Accommodations

If you require assistance due to a disability applying for open positions please submit a request via this Accommodations Request Form.

Posting Statement

At Salesforce we believe that the business of business is to improve the state of our world. Each of us has a responsibility to drive Equality in our communities and workplaces. We are committed to creating a workforce that reflects society through inclusive programs and initiatives such as equal pay, employee resource groups, inclusive benefits, and more. Learn more about Equality at Salesforce and explore our benefits.

Salesforce.com and Salesforce.org are Equal Employment Opportunity and Affirmative Action Employers. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, or disability status. Salesforce.com and Salesforce.org do not accept unsolicited headhunter and agency resumes. Salesforce.com and Salesforce.org will not pay any third-party agency or company that does not have a signed agreement with Salesforce.com or Salesforce.org.

Salesforce welcomes all.