Senior Security Incident Handler/Responder - Salesforce.com Sydney, New South Wales, Australia Bookmark Share Print 304 1 3

Listing Description

Salesforce has one of the best Information Security teams in the world and growing this area of the business is a top priority! Our Information Security teams work hand in hand with the business to ensure the highest security around all of our applications. The Computer Security Incident Response Team (CSIRT) is responsible for 24x7x365 security monitoring and rapid incident response across all Salesforce environments. We are the ‘tip of the spear’ and the last line of defense in protecting company and customer data from our adversaries.

As a key member of our growing CSIRT, the Senior Security Incident Handler will work on the ‘front lines’ of the Salesforce production environment, assisting a team that protects our critical infrastructure and our customers’ data from the latest information security threats. The Senior Security Incident Handler will lead the response to high severity incidents, act as a technical escalation point for the team, and perform other security monitoring/incident response functions as needed.

This individual will also lead significant strategic projects, focused on enhancements to the CSIRT’s capabilities to help ensure the Salesforce CSIRT remains an industry leader in Incident Response.

This position is based in our Sydney security operations center that is part of our 24x7x365 global security operations. This role generally works 5 days a week during business hours and may require some weekend work.

APPLY HERE: https://careers.secure.force.com/jobs/apex/ts2__JobDetails?jobId=a1k70000003GQK4AAO5+ years experience in the Information Security field, including operational security monitoring, incident response, or offensive security experience.

Experience monitoring devices such as network and host-based intrusion detection systems, web application firewalls, database security monitoring systems, firewalls/routers/switches, proxy servers, antivirus systems, file integrity monitoring tools, and operating system logs.

Experience responding to security incidents in a production environment, such as investigating and remediating possible endpoint malware infections and mitigating email borne threats such as spam and phishing.

The ability to cross-functionally lead and coordinate the response to high priority, high visibility operational security issues.

The ability to build strong relationships with peers both internal and external to your functional group, and with peers/professional organizations outside of the company.

The ability to train and mentor other Incident Handlers in technical and complex incident response techniques.

Strong technical understanding of network fundamentals and common internet protocols.

Strong technical understanding of administration and security controls with at least two of the following operating systems; Mac OS X, Microsoft Windows, or Linux/Unix system.

System forensics/investigation skills, including analyzing system artifacts (file system, memory, running processes, network connections) for indicators of infection/compromise.

Strong technical understanding of the information security threat landscape (attack vectors and tools, best practices for securing systems and networks, etc.).

Must have strong verbal and written communication skills; ability to communicate effectively and clearly to both technical and non-technical staff.

(Highly Desired Skills) Experience using security incident and event management tools for hunting and investigating security incidents is a benefit.

(Highly Desired Skills) Ability to take technical incident response concepts and apply them in detection and hunting scenarios.

(Highly Desired Skills) Prior experience in a 24x7x365 operations environment.

(Highly Desired Skills) Experience in malware static/behavioral reversing.

(Highly Desired Skills) Experience translating highly technical incident response problems into business risks.

(Highly Desired Skills)Relevant information security certifications, such as CISSP, SANS GCIA, SANS GCIH, SANS GPEN, SANS GCFA, SANS GNFA, SANS GREM, or Offensive Security OSCP/OSCE.

(Highly Desired Skills) Scripting skills (i.e. Python/Perl/Ruby, shell scripting) or development experience is a significant plus.