Incident Response Analyst: MDR & CIRT Specialist

Sophos; Greater London; Hybrid; GBP 55,000 - 75,000; Full time

Benefits offered by this job

Remote-first working model

Hybrid options

Flexible start times

Leadership development program

LinkedIn Learning access

Wellbeing program

Job summary

Sophos is seeking an intermediate-level Incident Response Analyst to support its Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT). You will perform advanced investigative, forensic, and containment activities, operating with moderate autonomy and mentoring junior analysts to ensure high-quality engagement outcomes.

As an Incident Response Analyst 2, you will be the technical backbone of engagements, provide customer-facing context, prepare

Qualifications

• 2+ years of experience in incident response, MDR, SOC, or security operations roles.
• Familiarity with OSQuery, SQL, or KQL.
• Knowledge of MITRE ATT&CK and incident response frameworks.
• Experience contributing to playbooks, detection tuning, or service improvement initiatives.

Responsibilities

• Perform advanced investigative and forensic analysis across endpoints, network logs, and cloud telemetry.
• Execute containment and response actions to neutralize active threats as directed by Incident Advisors or Senior Analysts.
• Validate indicators of compromise and correlate alerts, artifacts, and telemetry to determine scope and root cause.
• Maintain engagement documentation, trailheads, timelines and playbooks.

Skills

Incident response

Malware analysis

Forensic analysis

Communication skills

Mentoring juniors

Education

GCIH certification

GCED certification

CompTIA Security+

Tools

EDR tooling

SIEM platforms

Forensic collection tools

Job description

Sophos is seeking an intermediate-level Incident Response Analyst to support its Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT). You will perform advanced investigative, forensic, and containment activities, operating with moderate autonomy and mentoring junior analysts to ensure high-quality engagement outcomes.

As an Incident Response Analyst 2, you will be the technical backbone of engagements, provide customer-facing context, prepare