Principal Threat Researcher, Software Engineer (Counter-Threat Ops)

To get the best candidate experience, please consider applying for a maximum of 3 roles within 12 months to ensure you are not duplicating efforts. Job Category Software Engineering Job Details About Salesforce Salesforce is the #1 AI CRM, where humans with agents drive customer success together. Here, ambition meets action. Tech meets trust. And innovation isn’t a buzzword — it’s a way of life. The world of work as we know it is changing and we're looking for Trailblazers who are passionate about bettering business and the world through AI, driving innovation, and keeping Salesforce's core values at the heart of it all. Ready to level-up your career at the company leading workforce transformation in the agentic era? You’re in the right place! Agentforce is the future of AI, and you are the future of Salesforce. Our Threat Intelligence team focuses on defending our organization and our customers by cutting through the noise and identifying who’s targeting us and what emerging threats we need to prepare for. Our team includes those who have faced nation state, eCrime, and other types of adversaries in threat intelligence, incident response, and/or threat detection functions in past lives. We use our wide expertise to drive direction, support investigations, and uplift security as a whole across Salesforce. Role Description: As a Principal Threat Researcher (Counter-Threat Ops), you don't just track threats—you neutralize them. You are a key pillar of the Threat Intelligence (TI) team, specifically focused on the art of adversary disruption. You will lead the charge in identifying, tracking, and imposing friction on threat actors targeting the Salesforce ecosystem. This is a hands-on-keyboard technical leadership role as an individual contributor. You will perform deep-dive research across massive datasets to extract tactics, techniques and procedures (TTPs), build complex attacker profiles, and turn that intelligence into action. Whether you are partnering with hyperscalers to take down attacker infrastructure or working alongside multi-national law enforcement to support criminal prosecution, your goal is to make it expensive and dangerous for adversaries to operate against Salesforce and our Customers. Responsibilities Adversary Disruption & Denial: Lead initiatives to disrupt threat actor operations by leveraging Salesforce infrastructure and strategic partnerships with hyperscalers (AWS, GCP, MAS), CDNs, and network security providers. Law Enforcement Collaboration: Develop high-fidelity technical evidence and attribution data to support US and European law enforcement in the successful criminal prosecution of threat actors. Strategic Intelligence Ecosystem: Deepen Salesforce’s reach into the broader cyber intelligence community, fostering peer-to-peer partnerships with other industry disruption teams to build a collective defensive picture. Advanced Threat Tracking: Perform expert-level tracking of advanced e-crime and state-sponsored actors, distilling complex tactics, techniques, and procedures (TTPs) into actionable intelligence for executives and technical stakeholders. Tactical Tooling & Automation: Build custom scripts, investigative tools, and automation (Python, SQL, Splunk) to scale research and enable on-the-fly analysis during active campaigns or incident response. Technical Mentorship: Serve as a technical mentor on the Threat Intelligence team, guiding junior researchers and driving the direction of investigations through deep subject matter expertise. You will be collaborating on this with Cross-Functional Influence: Act as a central bridge between Incident Response, Security Engineering, and Platform Defense to ensure intelligence directly hardens our environment. Build and ship high-quality, production-grade software using modern engineering practices, with AI as a core part of your development workflow by pushing the boundaries of AI development tools to deliver secure, optimized, and hig ... (truncated, view full listing at source)