Incident Response Engineer

Sophos; Greater London; Hybrid; GBP 55,000 - 75,000; Full time

Benefits offered by this job

Remote-first working model

Hybrid options

Flexible start times

Leadership development program

LinkedIn Learning access

Wellbeing program

Job summary

Sophos is seeking an intermediate-level Incident Response Analyst to support its Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT). You will perform advanced investigative, forensic, and containment activities, operating with moderate autonomy and mentoring junior analysts to ensure high-quality engagement outcomes.

As an Incident Response Analyst 2, you will be the technical backbone of engagements, provide customer-facing context, prepare

Qualifications

• 2+ years of experience in incident response, MDR, SOC, or security operations roles.
• Familiarity with OSQuery, SQL, or KQL.
• Knowledge of MITRE ATT&CK and incident response frameworks.
• Experience contributing to playbooks, detection tuning, or service improvement initiatives.

Responsibilities

• Perform advanced investigative and forensic analysis across endpoints, network logs, and cloud telemetry.
• Execute containment and response actions to neutralize active threats as directed by Incident Advisors or Senior Analysts.
• Validate indicators of compromise and correlate alerts, artifacts, and telemetry to determine scope and root cause.
• Maintain engagement documentation, trailheads, timelines and playbooks.

Skills

Incident response

Malware analysis

Forensic analysis

Communication skills

Mentoring juniors

Education

GCIH certification

GCED certification

CompTIA Security+

Tools

EDR tooling

SIEM platforms

Forensic collection tools

Job description

• Sophos is seeking an intermediate-level Incident Response Analyst to support its Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT)
• As an Incident Response Analyst 2, you will perform advanced investigative, forensic, and containment activities during active cyber incidents. You will operate with moderate autonomy, serve primarily in an Incident Responder role, and begin supporting Incident Advisors with validated technical findings and customer-facing context
• This role serves as the technical backbone of most engagements and includes mentoring junior analysts to ensure consistent execution and documentation quality
• Perform advanced investigative and forensic analysis across endpoints, network logs, and cloud telemetry
• Execute containment and response actions to neutralize active threats as directed by Incident Advisors or Senior Analysts
• Validate indicators of compromise (IOCs) and correlate alerts, artifacts, and telemetry to determine scope and root cause
• Maintain clear and accurate engagement documentation, including trailheads, timelines, and playbooks
• Provide guidance and mentorship to junior IR and SOC analysts to ensure adherence to CIRT investigative and documentation standards
• Prepare technical findings and summaries for inclusion in customer updates and post-incident reports
• Identify and communicate detection or response gaps observed during investigations
• Participate in shift handovers, debriefs, and post-incident reviews to ensure engagement continuity
• Maintain accurate time and activity tracking to support operational visibility and service improvement

Benefits

• We encourage teams to get together in person periodically to help facilitate teamwork
• Remote-first working model & hybrid options
• Flexible start and end times for many roles
• Leadership development program
• Access to LinkedIn Learning
• Global internal coaching program (Coach Match)
• Periodic Sophos wellness days off for all Sophos to help employees relax and recharge
• Global wellbeing program, which offers a range of wellbeing resources, including Sophos Wellbeing Webinars, Stress Management Toolkits, and Developing Resilience Courses
• Free Employee Assistance Program (EAP) for confidential advice and counseling on a wide range of work and personal issues
• Free annual subscription to the Calm app
• Paid parental leave, caregiver leave & bereavement/compassion leave available
• We host some unforgettable social experiences for our global teams including our music festival SOPH-Fest, go-karting, Sophmudder, and incredible holiday parties!
• Our annual global fitness challenge, SOPH-Fit, sees thousands of employees taking part in our virtual global race around the world
• Each quarter, we celebrate our exceptional global team by running the Sophos Values Awards, which recognizes and rewards employees who embody the Sophos values and who we are as a company
• Health care benefits available worldwide

Ability to work effectively in high-pressure, time-sensitive incident environmentsExperience investigating malware, credential theft, ransomware, or similar threatsStrong written and verbal communication skills for documenting findings and contributing to customer updatesAbility to correlate alerts and telemetry to determine incident scope and root causeExperience mentoring or guiding junior analystsWillingness to work some weekends and holidays as part of a rotationSolid technical understanding of endpoint forensics, log analysis, and common attack techniques2+ years of experience in incident response, MDR, SOC, or security operations rolesFamiliarity with OSQuery, SQL, or KQLResearch shows that candidates sometimes hesitation to apply if they don’t check every box in a job description. We challenge that notion. Your unique experiences and skills might be exactly what we need to enhance our team. Don’t let a checklist hold you back – Industry certifications such as GCIH, GCED, CompTIA Security+, or equivalentKnowledge of MITRE ATT&CK and incident response frameworksExperience contributing to playbooks, detection tuning, or service improvement initiativesHands-on experience with EDR, SIEM, and forensic collection tools