Senior Security Specialist

As a Senior Security Specialist, you will join Sage’s global Cyber Defence team and play a key role in protecting Sage’s systems, data, and customers. This is a hands-on senior technical role (Tier 3) focused on advanced incident response and complex security investigations, including incident investigation, containment, remediation, and post-incident analysis. You will respond to complex and escalated security incidents while strengthening Sage’s detection and response capabilities. You will own and lead investigations of critical security incidents (high-severity), perform forensic analysis, and proactively hunt for indicators of compromise across cloud and on-premises environments. You will also improve detection rules, develop response playbooks, and refine operational processes that strengthen Sage’s cyber defence capabilities. You will partner with Product Engineering, IT, Cloud Operations, Legal, and other cybersecurity teams to lead investigations and drive remediation across Sage’s global environment. Minimum Qualifications: • 5 years of experience in cyber security responding to medium to critical security incidents • Strong hands-on experience performing incident response activities including triage, investigation, containment, remediation, and post-incident analysis • Proficiency using SIEM and EDR platforms to investigate security events and analyze large volumes of security telemetry • Experience performing threat hunting and developing or tuning detection logic • Knowledge of cyber threat intelligence practices, including analyzing attacker tactics and techniques and applying intelligence to improve detections and investigations • Experience conducting incident investigations and forensic analysis to determine root cause and reconstruct attacker activity • Experience investigating incidents in cloud environments (Azure, AWS, or GCP) including identity systems, logging, and cloud-native telemetry • Experience working cross-functionally with engineering, IT, cloud operations, legal, and security teams to drive remediation • Ability to work the required schedule and participate in the on-call rotation Ideal/Bonus Qualifications • Experience investigating application-layer attacks, abuse cases, or SaaS platform threats • Advanced knowledge of cybersecurity and information security control best practices • Certifications such as CISSP, SANS, or incident response, threat hunting, or forensics certifications Work Schedule: Monday–Friday, 8:00am – 4:00pm PST Occasional adjusted hours (6:00am – 2:00pm PST) when covering UK colleagues during planned PTO Participation in a shared on-call rotation (one weekend per month) Location: Hybrid; 3 days per week from our Vancouver office and 2 days from home