Information Security Architect - CSIRT

Lead and independently conduct in-depth investigations of customer cybersecurity incidents using multi-source log data (Splunk, CrowdStrike Falcon NG-SIEM, SQL) to produce accurate timelines and defensible accounts of threat actor activity.

Execute containment actions such as credential rotation and IP blocks and escalate complex or strategic incidents appropriately.

Communicate investigation findings clearly to customers and internally, while proactively improving investigation processes and detection capabilities.

5+ years of hands-on security incident response experience actively performing technical investigations.

Proficient in log analysis tools and techniques including Splunk, CrowdStrike Falcon NG-SIEM, SQL with multi-source joins and regex parsing, performed independently.

Experience handling Account Takeover, credential compromise, data exfiltration, and API abuse incident types.

Strong familiarity with Salesforce products or comparable multi-tenant SaaS security environments.

Demonstrates strong independent analytical skills capable of driving investigations end-to-end under pressure without senior hand-holding.

Experience improving operational processes and automating repetitive workflows to increase team effectiveness.

Effective at bridging technical findings to non-technical audiences including customers via standard calls and reports.