Senior Threat Intelligence Researcher

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts.

Job Category

Job Details

About Salesforce

Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword - it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all.

Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce.

The Experience:

As a Senior Threat Intelligence Researcher (Production), you don't just track threats-you contextualize and produce organic intelligence about them. You are a key pillar of the Threat Intelligence (TI) team, specifically focused on intelligence production across our suite of products and threat actors we track. You will lead the charge in translating nuanced technical intelligence and actor tracking operations into synthesized intelligence products for a wide and diverse audience. Your work will directly support other aspects of TI’s threat actor tracking and disruption work, informing the business to take action that imposes friction on threat actors targeting the Salesforce ecosystem. This is a role where you need to have a baseline technical capability and proven intelligence analysis skills-you are already well-versed at producing various intelligence products in written form and you have proven expertise in briefing to multiple audiences, running from technical to executive. You will analyze new and emerging threats to Salesforce, our platforms, and our customers, and turn that intelligence into action. Crucial to this work is directly engaging TI customers across key phases of the Threat Intelligence Lifecycle-shaping planning & direction, executing dissemination, and soliciting feedback to continuously refine intelligence output. You also understand the value of Community engagement and will participate in not just disseminating intelligence internally but also sharing the nuance of our work within the broader Threat Community.

This candidate must be a U.S. citizen (U.S. born or naturalized) operating on U.S. Soil who does not hold dual citizenship with the ability to meet customer and government screening standards applicable to this role.

What You'll Actually Be Doing

• Lead technical pipeline development of capabilities focused on creation and delivery of intelligence products.

• Maintain and enhance Salesforce TI’s threat prioritization model to continually identify top threats to Salesforce.

• Coordinate and manage creation, organization, development, and delivery of threat intelligence quarterly briefings to senior security and company leadership.

• Serve as one of the primary team interfaces with threat intelligence customers, managing educational presentations and incorporating feedback into threat intelligence capability development.

• Lead the development of routine and ad hoc threat intelligence written products, and own the customer dissemination portfolio for the team.

• Consume and curate threat data to create intelligence assessments in support of our incident response, threat hunting, threat detection, security engineering, and risk prioritization missions.

• Consume and curate OSINT and paid-for vendor reporting to contextualize the threat landscape.

• Write scripts (or capability to learn how to) and tools to help with analysis and build automation to aid investigations and threat research using lessons learned.

• Build expertise on any threats targeting Salesforce and provide attribution to attacker activity when possible

• Identify new and existing threats and clearly distill this information to support finished intelligence to multiple internal partners, including executives.

• Perform intelligence research during incident response, supporting multiple teams and drive direction of investigations based on knowledge of attackers.

You're Our Person If You Have:

• At least 5 years of professional experience identifying patterns and trends across various data sources to distill findings concisely for various audiences at scale.

• 3+ years experience with Cyber Threat Intelligence writing for both technical, non-technical, and executive audiences - ideally with threat briefings, threat reports, blog posts, or similar finished intelligence.

• 3+ years experience conducting and correlating threat research using OSINT, paid-for threat vendors, incident response engagement data, and proprietary tools.

• A capable oral and written communicator, you are able to engage others in the business at multiple levels to translate threat research into actionable recommendations to shape the business.

• Experience identifying, tracking of advanced cyber threat actors, including government-backed and advanced e-crime adversaries; knowledge of advanced actor TTPs and how to translate these to various audiences.

• Established threat intelligence practitioner (active engagement in the Information Security or Threat Community with contacts is a big plus).

• Experience using various AI tools for large data set analysis and intelligence support.

• You operate in a semi-autonomous to autonomous manner, driving the delivery of projects and deliverables with minimal oversight across multiple teams.

• You can work actively as a part of a globally distributed team, including remote and in-person colleagues.

Even Better If You Have:

• 5 years hands-on experience with strategic intelligence writing and standard conventions (BLUF, Diamond Model, MITRE ATT&CK), with a proven track record of authoring dozens of research articles and public-facing blog posts.

• Capability to learn or experience with security analysis tools (Jupyter notebooks, Splunk, ElasticSearch, etc.).

• Experience with SOAR platforms.

• Experience with various AI tools.

• Experience with threats in AWS, Microsoft Azure, and Google Cloud.

• Experience or an understanding of hunting/IR tools used for host and network analysis.

• Experience using Threat Intelligence Platforms; building integrations with these platforms is a plus.

• You have an understanding of existing and emerging threats to an organization spanning multiple industries and threat profiles; any threat hunting experience is a big plus.

• Active member of private, invite-only Information Security trust groups with extensive industry and community contacts.

• You have performed all of the above “at scale“ in a large, complex environment

Unleash Your Potential

When you join Salesforce, you’ll be limitless in all areas of your life. Our benefits and resources support you to find balance andbe your best, and our AI agents accelerate your impact so you cando your best. Together, we’ll bring the power of Agentforce to organizations of all sizes and deliver amazing experiences that customers love. Apply today to not only shape the future - but to redefine what’s possible - for yourself, for AI, and the world.

Accommodations

If you need a reasonable accommodation during the application or the recruiting process, please submit a request via this Accommodations Request Form.

Please note that Salesforce uses artificial intelligence (AI) tools to help our recruiters assess and evaluate candidates’ resumes and qualifications throughout the recruiting process. Humans will always make any candidate selection and hiring decisions. Please see our Candidate Privacy Statement for more information about how we use your personal data and your rights, including with regard to use of AI tools and opt out options.

Posting Statement

Salesforce is an equal opportunity employer and maintains a policy of non-discrimination with all employees and applicants for employment. What does that mean exactly? It means that at Salesforce, we believe in equality for all. And we believe we can lead the path to equality in part by creating a workplace that’s inclusive, and free from discrimination. Know your rights: workplace discrimination is illegal. Any employee or potential employee will be assessed on the basis of merit, competence and qualifications - without regard to race, religion, color, national origin, sex, sexual orientation, gender expression or identity, transgender status, age, disability, veteran or marital status, political viewpoint, or other classifications protected by law. This policy applies to current and prospective employees, no matter where they are in their Salesforce employment journey. It also applies to recruiting, hiring, job assignment, compensation, promotion, benefits, training, assessment of job performance, discipline, termination, and everything in between. Recruiting, hiring, and promotion decisions at Salesforce are fair and based on merit. The same goes for compensation, benefits, promotions, transfers, reduction in workforce, recall, training, and education.