Security Operations Specialist

CarltonOne is a global B2B technology leader, and part of the Goldman Sachs portfolio, helping organizations around the world reward and inspire exceptional people. Our solutions empower employees to be more productive, sales teams to perform at their best, and customers to stay engaged and loyal.

Our platform powers the global engagement industry, enabling companies to deliver impactful employee recognition, customer loyalty, rewards, sales, and channel incentive programs. We partner with over 450 clients , 500 vendors , and serve 14 million members across 185 countries .

Beyond engagement, every CarltonOne solution drives our eco-action mission: funding tree planting to help restore the planet. To date, we’ve funded over 22 million trees and are on track to plant millions more each year. Learn more at carltonone.com .

About the Opportunity:

The Senior Security Incident Responder & Remediation Specialist owns the full lifecycle of security incidents at every severity — from triage through containment, remediation, and post-incident review — and acts as Incident Commander during major (P1) events. The environment spans two distinct domains: the internal corporate IT estate — identity, endpoints, servers, network, email, and SaaS administration — and the customer-facing revenue-generating platform. You are expected to be effective in both; internal IT security is not treated as secondary here. This is a hands-on-keyboard role. You do the technical work yourself: querying and correlating logs, traces, and metrics in Datadog and adjacent telemetry platforms to reconstruct what happened, and remediating the vulnerabilities and misconfigurations you surface rather than tracking other teams to do it. You also build and maintain the SOAR playbooks, automation, and detection logic the team runs on. This role suits a deeply experienced practitioner (roughly 4-6 years in SOC, IR, or blue team roles) who is already the person others elevate to, works with minimal direction, and sets the technical bar for how incidents are investigated, remediated, and closed.

For the first 90 days, the successful candidate will be expected to align their working hours with the EST time zone to facilitate onboarding, training, and integration with the team.

• Own incidents end-to-end at all severities: triage, investigation, containment, eradication, remediation, and closure
• Act as Incident Commander during P1 events — structured timeline tracking, evidence handling, and coordination across teams
• Make sound severity and escalation calls under time pressure, with appropriate judgment on when to pull in leadership or other stakeholders
• Maintain thorough incident documentation, including root cause and remediation steps, for every incident you own
• Investigate and respond across the internal corporate estate as fluently as the production platform — Active Directory / Entra ID compromise, endpoint and server intrusion, phishing and business email compromise, VPN and remote-access abuse, and SaaS tenant misuse
• Perform deep hands-on investigation directly in the telemetry: build and run queries across logs, traces, metrics, and dashboards in Datadog (and equivalent observability/EDR tooling) to establish scope, blast radius, and root cause
• Execute containment and remediation actions personally where access permits — isolating hosts, revoking credentials and sessions, patching, and correcting misconfigurations — rather than handing the work off and following up
• Coordinate with IT, engineering, and vendor teams as needed to drive incidents to closure

Detection & Automation

• Build, test, and maintain SOAR playbooks that automate triage, enrichment, and routine response actions
• Write and maintain scripts (Python, PowerShell, or similar) to reduce manual work across the incident lifecycle
• Tune SIEM detection rules and correlation logic based on incident findings and false-positive trends
• Run threat-hunting exercises using current threat intelligence and known adversary TTPs

Vulnerability Management & Remediation

• Own remediation of vulnerabilities and misconfigurations surfaced by scanning, incidents, and threat hunts — apply the fix, validate it, and close it out yourself wherever access allows
• Triage and prioritize vulnerability findings by real exploitability and business exposure, not raw CVSS score
• Remediate across internal IT systems as well as cloud workloads — OS and third-party patching, Active Directory / Entra ID hardening, endpoint configuration and MDM baselines, network and firewall rule review, and M365 / Google Workspace tenant security settings
• Build and maintain the queries, monitors, and dashboards in Datadog and related telemetry platforms that the team relies on for detection and investigation
• Escalate to system owners only where remediation genuinely sits outside your access, and drive those items to closure with clear evidence and timelines
• Lead or co-lead blameless post-incident reviews (PIRs) for incidents you've handled; document root cause and contributing factors
• Own action items from your incidents through to closure
• Maintain and improve the incident knowledge base and runbooks based on lessons learned
• Identify recurring manual work and propose or build automation to address it
• Mentor and coach analysts on triage, telemetry analysis, tooling, and escalation judgment; review their incident work and raise the team's technical standard
• Contribute incident trends and metrics (MTTD, MTTR, volume) to the Security Incident Manager for leadership reporting
• Participate in and help design tabletop exercises and IR training

Qualifications:

• 5-8 years of hands-on experience in incident response, SOC operations, or a blue team role, with deep ownership of incident handling and remediation (not alert monitoring or ticket coordination)
• Demonstrated experience independently investigating and closing security incidents, including root cause analysis and personally executing the remediation
• Deep hands-on knowledge of SIEM, SOAR, and observability/telemetry platforms — Datadog in particular, plus Microsoft Sentinel, Splunk, Rapid7, or Cortex XSOAR; able to write non-trivial log and metric queries and to build and tune detection rules
• Strong scripting ability (Python, PowerShell, or Bash) for building automation, playbooks, and ad-hoc analysis tooling
• Deep working understanding of adversary TTPs and the MITRE ATT&CK framework
• Practical vulnerability management and remediation experience — patching, hardening, credential and access remediation, and cloud misconfiguration fixes in AWS, Azure, or GCP
• Hands-on experience securing internal corporate IT infrastructure — Active Directory / Entra ID, Windows and macOS endpoint management (Intune, Jamf , or SCCM), M365 or Google Workspace security configuration, and network / VPN infrastructure
• Able to communicate incident details clearly in writing and to both technical and non-technical stakeholders

Preferred Qualifications

• GCIH, GCFA, GCIA, OSCP, CISSP, or CISM
• Depth in one cloud provider's native security and logging services ( GuardDuty , Defender for Cloud, or Security Command Center)
• Experience with SOAR platform automation and playbook design specifically (not just usage)
• Experience in an organization spanning both a corporate IT estate and a customer-facing SaaS production platform, with security responsibility across both
• Exposure to digital forensics or basic memory/network forensics tooling
• Prior experience contributing to or presenting incident metrics/dashboards

Here are some additional p erks that we provide:

• Access to our employee benefits portal for exclusive discounts.
• Monthly company-wide events, celebrations, and team activities.
• Bravo reward points program for recognition and appreciation.

We value diversity and inclusion and encourage all qualified people to apply. If we can make this easier through accommodation in the recruitment process, or if you need assistance to accommodate a disability, please contact us with the “Help” button in the application.