Senior Threat Analyst

Join Sophos, a global leader in cybersecurity, as a Senior Threat Analyst on our Managed Detection and Response (MDR) team. In this role, you will provide top-notch monitoring, detection, and response services to proactively defend customer environments against cyber threats. You will work alongside a team of cyber threat hunters, incident response analysts, engineers, and ethical hackers, using enterprise, log analysis, and endpoint collection systems to facilitate investigations and neutralize threats.

Responsibilities

• Monitor, investigate, and respond to alerts generated by the Sophos security stack, leading and mentoring Tier I Analysts through escalated cases.
• Conduct threat hunting to identify potential threats throughout the MDR customer base, and support detection tuning by identifying recurring false positives.
• Stay informed on threat actor behaviors, MITRE ATT&CK techniques, and Sophos threat research updates, proactively researching emerging IOCs and vulnerabilities.
• Must thrive within a team environment as well as on an individual basis
• Experience handling active threats, including containment, mitigation, and recovery efforts during security incidents
• Familiar with techniques such as persistence, privilege escalation, lateral movement, and defense evasion, and able to identify these in real-world environments
• Familiarity with common incident response workflows and security operations processes

Requirements

• Bachelor's degree in information technology, Computer Science, Cybersecurity or related field, or equivalent practical experience
• Ability to interpret and analyze Windows event logs and other telemetry data
• Customer-first mindset with professionalism and a focus on service excellence
• Understanding of core network concepts including TCP/IP, protocols, routing, and traffic analysis
• Working knowledge of Windows operating systems (both workstation and server), with additional experience in Linux (Ubuntu, Debian, RedHat) or macOS environments
• A passion for cybersecurity, continuous improvement, and staying current on threat trends
• 5+ years of hands-on experience in a Security Operations Center (SOC), Managed Detection and Response (MDR) environment, or cybersecurity-focused IT role
• Exposure to threat hunting methodologies and an understanding of attacker behavior and patterns
• Demonstrated experience contributing to real-time incident response efforts and threat investigations
• Strong analytical thinking and troubleshooting skills, with attention to detail in investigations and case documentation
• Willingness to participate in shift work including nights, weekends and holidays (our MDR service is 24x7x365)
• Excellent communication skills, with the ability to clearly explain findings to both technical and non-technical audiences
• Proficient in the use of endpoint and network security tools (e.g., EDR, IDS/IPS, malware detection platforms) with the ability to validate and triage complex alerts
• Natural curiosity and willingness to learn in a fast-paced, ever-changing threat landscape
• Familiarity with the MITRE ATT&CK framework and its application in detection and response
• Experience working with SIEM platforms and managing enterprise security telemetry
• Ability to write and interpret SQL queries for data analysis and investigation
• Experience with OSQuery and scripting skills, particularly in PowerShell
• Relevant and practical cybersecurity certifications (e.g., GSEC, GCIA, GCIH, PEN-200, Security Blue Team L1, TCM Academy SOC L1, or similar)