Senior Incident Response Lead – Remote

Sophos; Canada; Hybrid; CAD 109,000 - 181,000; Full time

Benefits offered by this job

Bonus eligibility

Comprehensive benefits package

Job summary

Sophos is seeking a Senior Incident Response Consultant to lead and execute high‑profile incident response engagements for customers worldwide. You will head a team of consultants, coordinate customer communications, and drive containment, eradication, and lessons‑learned activities with a focus on MITRE ATT&CK mappings.

You will produce executive‑level summaries and remediation guidance, mentor junior analysts, and collaborate across time zones to ensure timely, effective responses to cyber

Qualifications

• 5+ years leading incident response investigations involving ransomware.
• Experience leading BEC investigations.
• Experience with SIEM technologies (Splunk/ELK).
• Strong communication to executive stakeholders.

Responsibilities

• Lead kickoff calls with customers to understand the incident and set priorities.
• Direct forensic investigations and assign tasks to analysts.
• Provide concise executive updates and detailed written reports.
• Produce executive summary reports mapped to MITRE ATT&CK.
• Oversee multiple rapid response engagements concurrently.

Skills

Incident response leadership

Ransomware investigations

MITRE ATT&CK

SIEM (Splunk/ELK)

SQL queries

PowerShell/Python/Bash

Executive communication

Team mentoring

Education

Post-secondary cybersecurity education

Cybersecurity certifications (e.g., CISSP, GCFA)

Tools

Splunk

ELK

Job description

Sophos is seeking a Senior Incident Response Consultant to lead and execute high‑profile incident response engagements for customers worldwide. You will head a team of consultants, coordinate customer communications, and drive containment, eradication, and lessons‑learned activities with a focus on MITRE ATT&CK mappings.

You will produce executive‑level summaries and remediation guidance, mentor junior analysts, and collaborate across time zones to ensure timely, effective responses to cyber