Threat Intelligence Automation Engineer

Job Category: Software Engineering About Salesforce Salesforce is the leading AI-driven CRM, where collaborative innovation shapes customer success. Here, ambition meets action, and technology and trust are intertwined. We strive to enhance business and societal outcomes through AI, pushing the boundaries of innovation while upholding Salesforce's core values. Are you set to elevate your career at a forefront company transforming the workforce through AI? Join us at Salesforce, where our future relies on your contribution. Overview of the Role The Threat Intelligence team is dedicated to defending Salesforce and its customers by simplifying complexity—identifying who is targeting us and what emerging threats we must vigilantly prepare for. We are looking for a Threat Intelligence Automation Engineer to be a key player in our Counter-Threat Operations team. In this role, you will transform vast streams of adversary data into actionable insights by developing and optimizing large-scale automated systems—empowering our threat intelligence, Security Operations Center (SOC), and Incident Response (IR) teams to effectively combat modern threats. Location: Washington, D.C. | McLean, VA | Seattle, WA | San Francisco, CA Responsibilities Design and sustain automated pipelines and integrations within our Threat Intelligence Platform (TIP) and Security Orchestration, Automation, and Response (SOAR) frameworks to bolster rapid security operations. Collaborate closely with Threat Researchers to comprehend advanced adversary tactics and convert manual investigative workflows into automated, repeatable detection processes. Lead data collection initiatives—assess new data sources and act as the technical authority for ingestion and normalization processes. Enhance the intelligence production cycle through automations that reduce manual workloads, allowing practitioners to concentrate on complex strategic analyses. Required Qualifications 3+ years of experience in cybersecurity, including at least 1 year in security engineering, DevSecOps, or automation workflows. Advanced proficiency in Python for handling complex programming challenges; knowledge of Bash and JavaScript is advantageous. Practical experience with SOAR platform orchestration, using tools such as Palo Alto Cortex XSOAR, Splunk Phantom, Tines, or Swimlane. Experience creating and managing solutions on Amazon Web Services (AWS) with a fundamental understanding of large-scale distributed systems. Bachelor's degree in Cybersecurity, Computer Science, or a related technical field; or equivalent demonstrated expertise and successful technical deliverables. Preferred Qualifications Experience extending and administering Threat Intelligence Platforms like Vertex Synapse, ThreatConnect, Anomali, or MISP, including the development of integrations. Skilled in normalizing unstructured data via RESTful APIs and regular expressions (Regex), with experience mapping data to structured formats such as JSON. Familiarity with security analysis tools like Jupyter notebooks, Splunk, or Elasticsearch. Understanding of version control (git) and CI/CD best practices in security engineering operations. Experience with AI-assisted development tools (e.g., Claude Code, GitHub Copilot) and proficiency in prompt engineering. Experience in cloud-native automation and serverless computing, specifically AWS Lambda or Azure Functions; knowledge of Microsoft Azure or Google Cloud is a plus. Expertise in graph modeling using Vertex Synapse or similar graph-based technologies for mapping adversary networks and digital footprints. Relevant certifications like GCTI (GIAC Cyber Threat Intelligence), GPYC (GIAC Python Coder), or SOAR platform credentials. Operational knowledge of Linux environments and Unix command-line utilities. Experience working effectively in a distributed, global environment. Equal Opportunity Employer Salesforce adheres to a strict non-discrimination policy for all employees and job applicants. Our commitment to equality means we assess employees and candidates based on merit, competence, and qualifications, regardless of race, religion, color, national origin, sex, sexual orientation, gender identity, age, disability, veteran status, or any other protected category. This policy applies throughout the employment journey, including recruitment, hiring, job assignment, compensation, promotion, training, and performance evaluations. Compensation for this role will range based on factors such as location, job level, relevant experience, and skills. The typical base salary range is between $117,200 and $176,700 per year. In specific metropolitan areas like San Francisco and New York City, the base salary range for this position may be adjusted to between $141,200 and $194,200 annually. Note that this range refers solely to base salary and does not include bonuses, equity, or benefits. #J-18808-Ljbffr Broughton Group