Incident Response Engineer

Sophos, a leading cybersecurity company, as an Incident Response Engineer. In this intermediate-level role, you will support our Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT).

Responsibilities

• You will perform advanced investigative, forensic, and containment activities during active cyber incidents, operate with moderate autonomy, and serve primarily in an Incident Responder role.
• You will also mentor junior analysts and maintain clear and accurate engagement documentation.
• This is a remote-first position with flexible working hours and a range of benefits.
• Perform advanced investigative and forensic analysis across endpoints, network logs, and cloud telemetry during active cyber incidents.
• Execute containment and response actions to neutralize active threats as directed by Incident Advisors or Senior Analysts, and validate indicators of compromise (IOCs).
• Provide guidance and mentorship to junior IR and SOC analysts to ensure adherence to CIRT investigative and documentation standards.
• Strong written and verbal communication skills for documenting findings and contributing to customer updates
• Ability to correlate alerts and telemetry to determine incident scope and root cause

Requirements

• Ability to work effectively in high-pressure, time-sensitive incident environments
• Willingness to work some weekends and holidays as part of a rotation
• 2+ years of experience in incident response, MDR, SOC, or security operations roles

Preferred

• Experience investigating malware, credential theft, ransomware, or similar threats
• Experience mentoring or guiding junior analysts
• Solid technical understanding of endpoint forensics, log analysis, and common attack techniques
• Familiarity with OSQuery, SQL, or KQL
• Industry certifications such as GCIH, GCED, CompTIA Security+, or equivalent

Knowledge of MITRE ATT&CK and incident response frameworks

• Experience contributing to playbooks, detection tuning, or service improvement initiatives
• Hands-on experience with EDR, SIEM, and forensic collection tools

Research shows that candidates sometimes hesitate to apply if they don't check every box in a job description. We challenge that notion. Your unique experiences and skills might be exactly what we need to enhance our team. Don't let a checklist hold you back – we encourage you to apply