Security Operations Specialist

CarltonOne is a global B2B technology leader, and part of the Goldman Sachs portfolio, helping organizations around the world reward and inspire exceptional people. Our solutions empower employees to be more productive, sales teams to perform at their best, and customers to stay engaged and loyal.Our platform powers the global engagement industry, enabling companies to deliver impactful employee recognition, customer loyalty, rewards, sales, and channel incentive programs. We partner with over 450 clients, 500 vendors, and serve 14 million members across 185 countries .Beyond engagement, every CarltonOne solution drives our eco-action mission: funding tree planting to help restore the planet. To date, we’ve funded over 22 million trees and are on track to plant millions more each year. Learn more at carltonone.Com .About the Opportunity:
The Senior Security Incident Responder & Remediation Specialist owns the full lifecycle of security incidents at every severity — from triage through containment, remediation, and post-incident review — and acts as Incident Commander during major (P1) events. The environment spans two distinct domains: the internal corporate IT estate — identity, endpoints, servers, network, email, and SaaS administration — and the customer-facing revenue-generating platform. You are expected to be effective in both;
internal IT security isnot treated as secondary here. This is a hands-on-keyboard role. You do the technical work yourself: querying and correlating logs, traces, and metrics in Datadog and adjacent telemetry platforms to reconstruct what happened, and remediating the vulnerabilities and misconfigurations you surface rather than tracking other teams to do it. You also build and maintain the SOAR playbooks, automation, and detection logic the team runs on. This role suits a deeply experienced practitioner (roughly 4-6 years in SOC, IR, or blue team roles) who is already the person others elevate to, works with minimal direction, and sets the technical bar for how incidents are investigated, remediated, and closed.For the first 90 days, the successful candidate will be expected to align their working hours with the EST time zone to facilitate onboarding, training, and integration with the team.Own incidents end-to-end at all severities: triage, investigation, containment, eradication, remediation, and closureAct as Incident Commander during P1 events — structured timeline tracking, evidence handling, and coordination across teamsMake sound severity and escalation calls under time pressure, with appropriate judgment on when to pull in leadership or other stakeholdersMaintain thorough incident documentation, including root cause and remediation steps, for every incident you ownInvestigate and respond across the internal corporate estate as fluently as the production platform — Active Directory / Entra ID compromise, endpoint and server intrusion, phishing and business email compromise, VPN and remote-access abuse, and SaaS tenant misusePerform deep hands-on investigation directly in the telemetry: build and run queries across logs, traces, metrics, and dashboards in Datadog (and equivalent observability/EDR tooling) to establish scope, blast radius, and root causeExecute containment and remediation actions personally where access permits — isolating hosts, revoking credentials and sessions, patching, and correcting misconfigurations — rather than handing the work off and following upCoordinate with IT, engineering, and vendor teams as needed to drive incidents to closureDetection & Automation
Build, test, and maintain SOAR playbooks that automate triage, enrichment, and routine response actionsWrite and maintain scripts (Python, PowerShell, or similar) to reduce manual work across the incident lifecycleTune SIEM detection rules and correlation logic based on incident findings and false-positive trendsRun threat-hunting exercises using current threat intelligence and known adversary TTPsVulnerability Management & Remediation
Own remediation of vulnerabilities and misconfigurations surfaced by scanning, incidents, and threat hunts — apply the fix, validate it, and close it out yourself wherever access allowsTriage and prioritize vulnerability findings by real exploitability and business exposure, not raw CVSS scoreRemediate across internal IT systems as well as cloud workloads — OS and third-party patching, Active Directory / Entra ID hardening, endpoint configuration and MDM baselines, network and firewall rule review, and M365 / Google Workspace tenant security settingsBuild and maintain the queries, monitors, and dashboards in Datadog and related telemetry platforms that the team relies on for detection and investigationEscalate to system owners only where remediation genuinely sits outside your access, and drive those items to closure with clear evidence and timelinesLead or co-lead blameless post-incident reviews (PIRs) for incidents you've handled;
document root cause andcontributing factorsOwn action items from your incidents through to closureMaintain and improve the incident knowledge base and runbooks based on lessons learnedIdentify recurring manual work and propose or build automation to address itMentor and coach analysts on triage, telemetry analysis, tooling, and escalation judgment;
review their incident work and raise the team's technical standardContribute incident trends and metrics (MTTD, MTTR, volume) to the Security Incident Manager for leadership reportingParticipate in and help design tabletop exercises and IR trainingQualifications:
5-8 years of hands-on experience in incident response, SOC operations, or a blue team role, with deep ownership of incident handling and remediation (not alert monitoring or ticket coordination)Demonstrated experience independently investigating and closing security incidents, including root cause analysis and personally executing the remediationDeep hands-on knowledge of SIEM, SOAR, and observability/telemetry platforms — Datadog in particular, plus Microsoft Sentinel, Splunk, Rapid7, or Cortex XSOAR;
able to write non-trivial log and metric queries and to build and tune detection rulesStrong scripting ability (Python, PowerShell, or Bash) for building automation, playbooks, and ad-hoc analysis toolingDeep working understanding of adversary TTPs and the MITRE ATT&CK frameworkPractical vulnerability management and remediation experience — patching, hardening, credential and access remediation, and cloud misconfiguration fixes in AWS, Azure, or GCPHands-on experience securing internal corporate IT infrastructure — Active Directory / Entra ID, Windows and macOS endpoint management (Intune, Jamf, or SCCM), M365 or Google Workspace security configuration, and network / VPN infrastructureAble to communicate incident details clearly in writing and to both technical and non-technical stakeholdersPreferred Qualifications
GCIH, GCFA, GCIA, OSCP, CISSP, or CISMDepth in one cloud provider's native security and logging services ( GuardDuty, Defender for Cloud, or Security Command Center)Experience with SOAR platform automation and playbook design specifically (not just usage)Experience in an organization spanning both a corporate IT estate and a customer-facing SaaS production platform, with security responsibility across bothExposure to digital forensics or basic memory/network forensics toolingPrior experience contributing to or presenting incident metrics/dashboardsHere are some additional p erks that we provide:
Access to our employee benefits portal for exclusive discounts.Monthly company-wide events, celebrations, and team activities.Bravo reward points program for recognition and appreciation.We value diversity and inclusion and encourage all qualified people to apply. If we can make this easier through accommodation in the recruitment process, or if you need assistance to accommodate a disability, please contact us with the “Help” button in the application.
#J-18808-Ljbffr