Security Engineer, Threat Response

🔥 1 hour ago

🇨🇦 Canada – Remote

💵 $86k - $143k / year

⏰ Full Time

🟡 Mid-level

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Sophos

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 1985

💼 Consulting

🏥 Healthcare

🏭 Manufacturing

💰 Post-IPO Equity on 2021-08

Consulting • Healthcare • Manufacturing

Sophos is a leading cybersecurity company that specializes in protecting businesses against advanced cyber threats. The company offers a comprehensive suite of security solutions, including endpoint protection, managed detection and response (MDR), network security, and cloud security. With a prevention-first approach, Sophos aims to stop ransomware and other cyber threats before they cause harm. Sophos provides services such as threat research, security training, and operational support to ensure robust defense against cyberattacks. Their solutions cater to various industries including finance, healthcare, government, manufacturing, and retail. The Sophos Central platform delivers centralized security management, integrating seamlessly with existing IT infrastructure to enhance security posture.

📋 Description

• Independently detect, investigate and respond to cyber threats across Sophos and its products • Engineer detections, automations, reusable skills and agentic workflows that scale Internal Detection and Response • Own complex investigations across the incident lifecycle, from triage and evidence collection through containment, recovery and lessons learned • Coordinate response across IDR, engineering, product and business teams • Perform DFIR and endpoint forensics, including log, network and packet analysis, malware analysis and firewall investigation • Write and improve detections, playbooks, orchestrations and preventions using incident and threat-hunting evidence • Build production-quality automation to remove repetitive work and improve consistency • Design model-agnostic skills and workflows across approved AI and agent platforms • Use Claude, Codex, Copilot and approved tooling for investigations, coding, testing, documentation and detection engineering • Contribute through GitHub by creating branches, raising and reviewing pull requests, writing tests, responding to feedback and supporting controlled deployment • Instrument agentic workflows with logs, traces, metrics, evaluation results and failure signals • Apply safe harness design, least privilege, scoped tool access, approval gates, evidence validation, rollback and human review • Communicate incidents, risks, decisions and technical outcomes to engineering and leadership audiences

🎯 Requirements

• Strong enterprise incident response experience across endpoint, identity, cloud, network and product-focused investigations • Practical capability in DFIR, endpoint and firewall forensics, threat hunting, detection engineering and analysis of unstructured telemetry • Ability to write reliable automation in Python or a comparable language • Experience working with APIs and querying data using SQL • Working knowledge of Git and GitHub engineering practices, including pull requests, code review, testing and CI/CD concepts • Hands-on familiarity with Claude, Codex or comparable coding agents, including context design, task decomposition and validation of generated output • Ability to design and write evals for agentic workflows and skills • Understanding of agent architecture, tool use, skill-based design, model portability and AI or automation safety controls • Ability to design observability for automated work and use telemetry to troubleshoot, measure quality and improve reliability • Clear written and verbal communication, sound opsec judgement and ability to work effectively in a globally coordinated environment • Legal authorization to work in Canada without requiring employer sponsorship

🏖️ Benefits

• Bonus eligibility • Comprehensive benefits package • Remote-first working model • Employee-led diversity and inclusion networks • Annual charity and fundraising initiatives • Volunteer days • Global employee sustainability initiatives • Global fitness and trivia competitions • Global wellbeing days • Monthly wellbeing webinars and training