Remote Incident Response Analyst - MDR & Forensics Expert

Sophos; Oxford; Remote; AUD 120,000 - 160,000; Full time

Benefits offered by this job

Remote-first

Hybrid options

Wellbeing programs

Volunteer days

Job summary

Sophos is seeking an experienced Incident Response Analyst in Australia to lead the investigative stream for MDR customers within the Critical Incident Response Unit.

You will perform advanced forensic, analytical, and containment tasks across diverse environments, serving as a bridge between junior responders and senior analysts to ensure technical accuracy and high-quality documentation for customer communication.

Qualifications

• 3+ years of cyber security investigations.
• Knowledge of incident response tooling and methodologies.
• Experience creating technical documentation and reports.
• Ability to work under high-pressure situations, when response time matters, to disrupt adversary activity.
• Network and endpoint investigation across macOS/Linux/Windows; IDS, IPS, EDR, and basic malware analysis.
• Basic understanding of OSQuery, SQL, and KQL.
• Knowledge of MITRE ATT&CK and Cyber Kill Chain.
• Willing to work some weekends and holidays.
• Experience with Windows and Linux command shells.

Responsibilities

• Utilize Sophos technologies to investigate, contain, and respond to cyber incidents.
• Conduct analysis of cyber incidents for malware, ransomware, and other common attack types.
• Maintain accurate and detailed documentation for analysis performed during cyber incidents.
• Recognize and codify attacker tools, tactics, and procedures for current and future investigations.
• Provide clear and concise communication to MDR customers during cyber incidents.
• Work closely with internal SophosLabs, Detection Engineering, and Threat Hunting teams to improve detection logic.
• Collaborate with MDR Operations teams to provide response, remediation guidance, and excellent customer service.
• Assist in creating accurate and detailed technical incident reports as a post-incident deliverable for MDR customers and MSPs.

Skills

IR investigations

Threat hunting

Documentation

High-pressure

Network/Endpoint

MITRE ATT&CK

Scripting basics

Job description

Sophos is seeking an experienced Incident Response Analyst in Australia to lead the investigative stream for MDR customers within the Critical Incident Response Unit.

You will perform advanced forensic, analytical, and containment tasks across diverse environments, serving as a bridge between junior responders and senior analysts to ensure technical accuracy and high-quality documentation for customer communication.