CarltonOne is a global B2B technology leader, and part of the Goldman Sachs portfolio, helping organizations around the world reward and inspire exceptional people. Our solutions empower employees to be more productive, sales teams to perform at their best, and customers to stay engaged and loyal. Our platform powers the global engagement industry, enabling companies to deliver impactful employee recognition, customer loyalty, rewards, sales, and channel incentive programs. We partner with over 450 clients , 500 vendors , and serve 14 million members across 185 countries . Beyond engagement, every CarltonOne solution drives our eco-action mission: funding tree planting to help restore the planet. To date, we’ve funded over 22 million trees and are on track to plant millions more each year. Learn more at carltonone.com . About the Opportunity: The Senior Security Incident Responder & Remediation Specialist owns the full lifecycle of security incidents at every severity — from triage through containment, remediation, and post-incident review — and acts as Incident Commander during major (P1) events. The workplace spans two distinct domains: the internal corporate IT estate — identity, endpoints, servers, network, email, and SaaS administration — and the customer-facing revenue-generating platform. You are expected to be effective in both; internal IT security is not treated as secondary here. This is a hands-on-keyboard role. You do the technical work yourself: querying and correlating logs, traces, and metrics in Datadog and adjacent telemetry platforms to reconstruct what happened, and remediating the vulnerabilities and misconfigurations you surface rather than tracking other teams to do it. You also build and maintain the SOAR playbooks, automation, and detection logic the team runs on.



This role suits a deeply experienced practitioner (roughly 4-6 years in SOC, IR, or blue team roles) who is already the person others elevate to, works with minimal direction, and sets the technical bar for how incidents are investigated, remediated, and closed. For the first 90 days, the successful candidate will be expected to align their

working hours
with the EST time zone to facilitate onboarding, training, and integration with the team.
- Own incidents end-to-end at all severities: triage, investigation, containment, eradication, remediation, and closure
- Act as Incident Commander during P1 events — structured timeline tracking, evidence handling, and coordination across teams
- Make sound severity and escalation calls under time pressure, with appropriate judgment on when to pull in leadership or other stakeholders
- Maintain thorough incident documentation, including root cause and remediation steps, for every incident you own
- Investigate and respond across the internal corporate estate as fluently as the production platform — Active Directory / Entra ID compromise, endpoint and server intrusion, phishing and business email compromise, VPN and remote-access abuse, and SaaS tenant misuse
- Perform deep hands-on investigation directly in the telemetry: build and run queries across logs, traces, metrics, and dashboards in Datadog (and equivalent observability/EDR tooling) to establish scope, blast radius, and root cause




- Execute containment and remediation actions personally where access permits — isolating hosts, revoking credentials and sessions, patching, and correcting misconfigurations — rather than handing the work off and following up
- Coordinate with IT, engineering, and vendor teams as needed to drive incidents to closure Detection & Automation
- Build, test, and maintain SOAR playbooks that automate triage, enrichment, and routine response actions
- Write and maintain scripts (Python, PowerShell, or similar) to reduce manual work across the incident lifecycle
- Tune SIEM detection rules and correlation logic based on incident findings and false-positive trends
- Run threat-hunting exercises using current threat intelligence and known adversary TTPs Vulnerability Management & Remediation
- Own remediation of vulnerabilities and misconfigurations surfaced by scanning, incidents, and threat hunts — apply the fix, validate it, and close it out yourself wherever access allows
- Triage and prioritize vulnerability findings by real exploitability and business exposure, not raw CVSS score
- Remediate across internal IT systems as well as cloud workloads — OS and third-party patching, Active Directory / Entra ID hardening, endpoint configuration and MDM baselines, network and firewall rule review, and M365 / Google Workspace tenant security settings
- Build and maintain the queries, monitors, and dashboards in Datadog and related telemetry platforms that the team relies on for detection and investigation
- Escalate to system owners only where remediation genuinely sits outside your access, and drive those items to closure with clear evidence and timelines
- Lead or co-lead blameless post-incident rev

📌 Security Operations Specialist (Markham)
🏢 CarltonOne Engagement
📍 Markham