• Sophos is seeking an intermediate-level Incident Response Analyst to support its Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT)
• As an Incident Response Analyst 2, you will perform advanced investigative, forensic, and containment activities during active cyber incidents. You will operate with moderate autonomy, serve primarily in an Incident Responder role, and begin supporting Incident Advisors with validated technical findings and customer-facing context
• This role serves as the technical backbone of most engagements and includes mentoring junior analysts to ensure consistent execution and documentation quality
• Perform advanced investigative and forensic analysis across endpoints, network logs, and cloud telemetry
• Execute containment and response actions to neutralize active threats as directed by Incident Advisors or Senior Analysts
• Validate indicators of compromise (IOCs) and correlate alerts, artifacts, and telemetry to determine scope and root cause
• Maintain clear and accurate engagement documentation, including trailheads, timelines, and playbooks
• Provide guidance and mentorship to junior IR and SOC analysts to ensure adherence to CIRT investigative and documentation standards
• Prepare technical findings and summaries for inclusion in customer updates and post-incident reports
• Identify and communicate detection or response gaps observed during investigations
• Participate in shift handovers, debriefs, and post-incident reviews to ensure engagement continuity
• Maintain accurate time and activity tracking to support operational visibility and service improvement

Benefits

• We encourage teams to get together in person periodically to help facilitate teamwork
• Remote-first working model & hybrid options
• Flexible start and end times for many roles
• Leadership development program
• Access to LinkedIn Learning
• Global internal coaching program (Coach Match)
• Periodic Sophos wellness days off for all Sophos to help employees relax and recharge
• Global wellbeing program, which offers a range of wellbeing resources, including Sophos Wellbeing Webinars, Stress Management Toolkits, and Developing Resilience Courses
• Free Employee Assistance Program (EAP) for confidential advice and counseling on a wide range of work and personal issues
• Free annual subscription to the Calm app
• Paid parental leave, caregiver leave & bereavement/compassion leave available
• We host some unforgettable social experiences for our global teams including our music festival SOPH-Fest, go-karting, Sophmudder, and incredible holiday parties!
• Our annual global fitness challenge, SOPH-Fit, sees thousands of employees taking part in our virtual global race around the world
• Each quarter, we celebrate our exceptional global team by running the Sophos Values Awards, which recognizes and rewards employees who embody the Sophos values and who we are as a company
• Health care benefits available worldwide

• Ability to work effectively in high-pressure, time-sensitive incident environments
• Experience investigating malware, credential theft, ransomware, or similar threats
• Strong written and verbal communication skills for documenting findings and contributing to customer updates
• Ability to correlate alerts and telemetry to determine incident scope and root cause
• Experience mentoring or guiding junior analysts
• Willingness to work some weekends and holidays as part of a rotation
• Solid technical understanding of endpoint forensics, log analysis, and common attack techniques
• 2+ years of experience in incident response, MDR, SOC, or security operations roles
• Familiarity with OSQuery, SQL, or KQL
• Research shows that candidates sometimes hesitate to apply if they don’t check every box in a job description. We challenge that notion. Your unique experiences and skills might be exactly what we need to enhance our team. Don’t let a checklist hold you back – we encourage you to apply
• Industry certifications such as GCIH, GCED, CompTIA Security+, or equivalent
• Knowledge of MITRE ATT&CK and incident response frameworks
• Experience contributing to playbooks, detection tuning, or service improvement initiatives
• Hands-on experience with EDR, SIEM, and forensic collection tools