Senior Incident Response Lead — Remote

Sophos; Canada; On-site; CAD 131,000 - 219,000; Full time

Job summary

Sophos seeks an experienced Senior Incident Response Consultant to join our DFIR team in a remote-first, largely Canada-based role. You will lead incident response engagements, coordinate with customers and stakeholders, and deliver clear executive summaries with MITRE ATT&CK alignment.

You will manage multiple incidents, mentor junior analysts, and help drive the development of the Sophos DFIR service through practical, high‑impact investigations and remediation guidance.

Qualifications

• Experience leading incident response investigations (ransomware, breaches, threats).
• Experience with cloud forensics (AWS, Azure, GCP).
• Strong written and verbal communication; able to mentor analysts.

Responsibilities

• Lead incident response engagements with customers.
• Coordinate with legal and cyber insurance as needed.
• Produce executive summary reports with MITRE ATT&CK mapping.
• Direct forensic investigations and prioritize tasks across incidents.
• Provide regular written updates between calls.

Skills

Incident response leadership

Digital forensics

Team leadership

MITRE ATT&CK

Threat intel

Communication

Education

Bachelor's degree in CS/Security

Tools

Splunk

ELK

SQL

PowerShell

Python

Bash

Job description

Sophos seeks an experienced Senior Incident Response Consultant to join our DFIR team in a remote-first, largely Canada-based role. You will lead incident response engagements, coordinate with customers and stakeholders, and deliver clear executive summaries with MITRE ATT&CK alignment.

You will manage multiple incidents, mentor junior analysts, and help drive the development of the Sophos DFIR service through practical, high‑impact investigations and remediation guidance.