Senior Incident Response Engineer

🔥 5 minutes ago

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Sophos

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 1985

💼 Consulting

🏥 Healthcare

🏭 Manufacturing

💰 Post-IPO Equity on 2021-08

Consulting • Healthcare • Manufacturing

Sophos is a leading cybersecurity company that specializes in protecting businesses against advanced cyber threats. The company offers a comprehensive suite of security solutions, including endpoint protection, managed detection and response (MDR), network security, and cloud security. With a prevention-first approach, Sophos aims to stop ransomware and other cyber threats before they cause harm. Sophos provides services such as threat research, security training, and operational support to ensure robust defense against cyberattacks. Their solutions cater to various industries including finance, healthcare, government, manufacturing, and retail. The Sophos Central platform delivers centralized security management, integrating seamlessly with existing IT infrastructure to enhance security posture.

📋 Description

• Lead kickoff calls with customers to understand their situation and identify initial response actions to contain threats • Provide guidance to customers on incident-response best practices • Lead daily customer update calls and deliver forensic findings • Send concise email updates between calls • Direct forensic investigations, identify priorities, and delegate tasks to analysts • Conduct multiple Rapid Response incidents concurrently • Determine analysts’ identified TTPs and add them to the threat intelligence platform • Write timely, clear, concise executive-summary-style reports • Lead basic-to-moderate complexity projects contributing to Sophos Rapid Response service development • Provide daily handover notes to teams in different time zones or when incident responsibility transfers • Ensure response actions neutralize threats and conduct root-cause analysis, including possible data exfiltration • Produce final reports with event timelines mapped to MITRE ATT&CK and remediation guidance • Mentor and assist junior analysts

🎯 Requirements

• 5+ years of experience leading incident response investigations involving ransomware • Experience leading BEC investigations • Continuous learning and awareness of the changing threat landscape • Proven success neutralizing and remediating ransomware threats • Excellent understanding of the incident response process • Excellent understanding of cyber risks and ability to qualify them for customers • Excellent oral communication skills • Strong written communication skills • Ability to manage time effectively • Ability to delegate and prioritize tasks across multiple incidents • Ability to perform under stressful circumstances • Willingness to begin work early and/or stay late when warranted for customer engagements • Strong grasp of the MITRE ATT&CK framework • Willingness to mentor junior analysts • Team-player attitude and willingness to share knowledge • Ability to work weekends and holidays • Post-secondary education in Cybersecurity or comparable • Cybersecurity certifications such as CISSP or GCFA are an asset • Experience with SIEM technologies such as Splunk or ELK is desirable • Willingness to work occasional overtime during peak times or holidays • Experience writing SQL queries is desirable • Experience writing PowerShell, Python, or Bash scripts is desirable

🏖️ Benefits

• Remote-first working model • Employee-led diversity and inclusion networks • Annual charity and fundraising initiatives • Volunteer days • Global employee sustainability initiatives • Global fitness and trivia competitions • Global wellbeing days • Monthly wellbeing webinars and training • Equal opportunity and recruitment-process adjustments for applicants