Security Engineer (Threat Response), Sophos Security Team (IDR)

Sophos; Canada; On-site; CAD 110,000 - 160,000; Full time

Job summary

Forensic Focus in Canada seeks an experienced incident responder to lead investigations across the full incident lifecycle, from triage to containment and recovery. The role covers endpoints, networks, identity, and cloud environments, and emphasizes building detections, automations and AI-assisted workflows to scale internal response.

You will collaborate with engineering and security teams, translate complex technical findings for non-technical stakeholders, and help mature the company’s DFIR

Qualifications

• Strong enterprise incident response experience and practical DFIR knowledge.
• Proficiency in Python, SQL and version control practices.
• Ability to communicate technical findings across teams.

Responsibilities

• Lead investigations across the incident lifecycle from triage to containment and recovery.
• Develop detections, automations and AI-assisted workflows to scale response.
• Collaborate with engineering and security teams to strengthen capabilities across endpoints, networks, identities and cloud.

Skills

Incident response

DFIR

Endpoint forensics

Network analysis

Threat hunting

Python

SQL

Git/GitHub

Automation design

AI tooling

Job description

The Role

This role leads investigations across the incident lifecycle, from triage and evidence collection through containment and recovery, covering endpoint, network, identity and cloud environments. It also involves building detections, automations and AI-assisted workflows to scale internal response capability.

Skills & Experience

Requires strong enterprise incident response experience, practical DFIR and endpoint/firewall forensics, malware and network analysis, and threat hunting. Candidates should be proficient in Python, SQL, Git/GitHub practices, and have familiarity with AI coding agents and automation design.

Who It Suits

Suited to experienced incident responders who enjoy combining hands-on forensic investigation with engineering, automation and emerging AI tooling, and who can communicate technical findings clearly across teams.