Manager, Incident Response

🕒 August 21

🇮🇳 India – Remote

⏰ Full Time

🟠 Senior

🔴 Lead

👔 Manager

👻 Ghost score 10%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Sophos

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 1985

💼 Consulting

🏥 Healthcare

🏭 Manufacturing

💰 Post-IPO Equity on 2021-08

Consulting • Healthcare • Manufacturing

Sophos is a leading cybersecurity company that specializes in protecting businesses against advanced cyber threats. The company offers a comprehensive suite of security solutions, including endpoint protection, managed detection and response (MDR), network security, and cloud security. With a prevention-first approach, Sophos aims to stop ransomware and other cyber threats before they cause harm. Sophos provides services such as threat research, security training, and operational support to ensure robust defense against cyberattacks. Their solutions cater to various industries including finance, healthcare, government, manufacturing, and retail. The Sophos Central platform delivers centralized security management, integrating seamlessly with existing IT infrastructure to enhance security posture.

📋 Description

• Lead and develop squads of analysts across the Critical Incident Response Team • Own day-to-day CIRT operations across multiple squads, including staffing, coverage, workload balancing, prioritization, and service-level performance • Provide senior technical leadership and act as Incident Commander for complex or high-severity engagements • Coordinate investigation, containment, eradication, recovery, and customer communications through resolution • Establish and maintain operational and investigative quality standards • Ensure approved processes, playbooks, documentation, case reviews, and post-incident actions are completed accurately • Use operational, quality, response-time, capacity, and customer-outcome metrics to manage performance and drive improvements • Maintain skills coverage, onboarding and training plans, incident exercises, tooling needs, and playbook updates • Serve as a senior escalation point for customer concerns, material findings, delivery risks, and resource conflicts • Translate complex technical issues into clear updates and actionable decisions for technical and executive stakeholders • Partner with Threat Intelligence, Security Operations Center, Detection Engineering, Product, and other teams • Drive continuous improvement and standardization through improved workflows, automation, training, and service enhancements

🎯 Requirements

• 7+ years of experience in cybersecurity operations, incident response, digital forensics, or a related discipline • At least 2 years leading people, teams, or operational functions • Experience managing incident response operations across multiple concurrent engagements • Strong technical background in endpoint, network, and cloud security • Ability to investigate indicators of compromise, determine scope and root cause, and direct containment, eradication, and remediation efforts • Experience serving as an Incident Commander or senior technical escalation point during high-pressure incidents • People-leadership experience including coaching, performance management, career development, hiring or onboarding, and team building • Experience using operational metrics, quality reviews, and customer feedback to deliver improvements in a security operations or managed services environment • Deep understanding of attacker tools, tactics, and procedures, including persistence, lateral movement, credential theft, ransomware, and defense evasion • Working knowledge of the MITRE ATT&CK framework • Excellent written and verbal communication skills • Strong analytical and troubleshooting ability • A degree in Information Technology, Computer Science, or a related field, or relevant, commensurate work experience • Advanced cybersecurity certifications preferred, such as GCFE, GCFA, GCIH, or CISSP • Experience with distributed, global, or 24x7 incident response or security operations teams • Experience with SIEM, EDR, forensic collection, and threat intelligence platforms • Practical use of OSQuery, SQL, PowerShell, KQL, CyLR, Velociraptor, or comparable tools • Experience developing incident response playbooks, training programs, tabletop exercises, or readiness initiatives

🏖️ Benefits

• Remote-first working model • Employee-led diversity and inclusion networks • Annual charity and fundraising initiatives • Volunteer days • Global employee sustainability initiatives • Global fitness and trivia competitions • Global wellbeing days • Monthly wellbeing webinars and training • Equality of opportunity and reasonable recruitment-process adjustments