Sophos is seeking an entry-level Incident Response Analyst to support its Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT).
As an Incident Response Analyst 1, you will support investigative, forensic, and containment activities during active cyber incidents under the close supervision of senior analysts and Incident Advisors. You will serve in a supporting Incident Responder role focused on alert triage, evidence collection, and documentation. This role is the entry point into the CIRT and is designed to build the technical foundations needed to progress into more autonomous investigative work, with mentorship and guidance provided throughout.
What you will do
Assist with investigative and forensic analysis across endpoints, network logs, and cloud telemetry under the direction of senior analysts
Support containment and response actions to neutralize active threats as directed by Incident Advisors or Senior Analysts
Triage and review alerts, indicators of compromise (IOCs), artifacts, and telemetry, escalating findings to senior analysts to help determine scope and root cause
Maintain clear and accurate engagement documentation, including trailheads, timelines, and playbooks
Develop incident response skills through hands-on engagements while following CIRT investigative and documentation standards
Contribute technical findings and summaries to support customer updates and post-incident reports
Identify and communicate detection or response gaps observed during investigations
Participate in shift handovers, debriefs, and post-incident reviews to ensure engagement continuity
Maintain accurate time and activity tracking to support operational visibility and service improvement
What you will bring
1-2 years of experience in a SOC, MDR, or security operations role preferred; this is an entry point into incident response
Foundational technical understanding of endpoint security, log analysis, and common attack techniques
Familiarity with common threats such as malware, credential theft, and ransomware
Ability to review and triage alerts and telemetry, escalating to senior analysts as appropriate
Strong written and verbal communication skills for documenting findings and contributing to customer updates
Eagerness to learn and develop technical skills with guidance from senior analysts
Ability to work effectively in high-pressure, time-sensitive incident environments
Willingness to work some weekends and holidays as part of a rotation
Exposure to EDR, SIEM, or forensic collection tools
Familiarity with OSQuery, SQL, or KQL
Knowledge of MITRE ATT&CK and incident response frameworks
Industry certifications such as CompTIA Security+, GFACT, GCIH, or equivalent
Interest in contributing to playbooks, detection tuning, or service improvement initiatives
Essential:
Desired:
Skills Required
- 1-2 years of experience in a SOC, MDR, or security operations role
- Foundational technical understanding of endpoint security, log analysis, and common attack techniques
- Familiarity with common threats such as malware, credential theft, and ransomware
- Ability to review and triage alerts and telemetry, escalating to senior analysts as appropriate
- Strong written and verbal communication skills for documenting findings and contributing to customer updates
- Eagerness to learn and develop technical skills with guidance from senior analysts
- Ability to work effectively in high-pressure, time-sensitive incident environments
- Willingness to work some weekends and holidays as part of a rotation
- Legal authorization to work in the jurisdiction where the position is posted without employer sponsorship
- Exposure to EDR, SIEM, or forensic collection tools
- Familiarity with OSQuery, SQL, or KQL
- Knowledge of MITRE ATT&CK and incident response frameworks
- Industry certifications such as CompTIA Security+, GFACT, GCIH, or equivalent
- Interest in contributing to playbooks, detection tuning, or service improvement initiatives
Sophos Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Sophos and has not been reviewed or approved by Sophos.
-
Leave & Time Off Breadth — Time away is positioned as broad, with company-wide wellness days plus dedicated learning days and paid volunteer time.
-
Parental & Family Support — Family-related leave appears more comprehensive than baseline offerings, including paid parental leave, caregiver leave, and extended bereavement leave.
-
Wellbeing & Lifestyle Benefits — Wellbeing support is emphasized through always-available assistance resources and a Calm subscription, suggesting a lifestyle-oriented benefits approach.
Sophos Insights
What We Do
Cybersecurity Evolved. As a worldwide leader in next-generation cybersecurity, Sophos protects nearly 400,000 organizations of all sizes in more than 150 countries from today’s most advanced cyberthreats. Powered by SophosLabs – a global threat intelligence and data science team – Sophos’ cloud-native and AI-enhanced solutions secure endpoints (laptops, servers and mobile devices) and networks against evolving cybercriminal tactics and techniques, including automated and active-adversary breaches, ransomware, malware, exploits, data exfiltration, phishing, and more.
.png)
