Remote Security Engineer: AI-Driven IR & Automation

Lever, Inc.; Oxford; Remote; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Remote-first culture

Hybrid opportunities

Job summary

Sophos is seeking a highly capable security engineer to independently detect, investigate and respond to cyber threats while engineering scalable detections and agentic workflows. You will use AI-assisted tools and production-grade automation to improve incident response effectiveness.

The role emphasizes DFIR, threat hunting and cross-functional collaboration across engineering, product and leadership to reduce risk and improve resilience.

Qualifications

• Experience in enterprise incident response across endpoints, identity, cloud and network.
• Proficient in DFIR, endpoint and firewall forensics, threat hunting and detection engineering.
• Able to write reliable automation in Python and query data via SQL.

Responsibilities

• Own complex investigations across the incident lifecycle from triage to lessons learned.
• Coordinate response across IDR, engineering, product and business teams.
• Perform DFIR and endpoint forensics, including malware and network analysis.
• Write and improve detections, playbooks and automations.
• Build production-grade automation to reduce repetitive tasks.
• Design reusable agentic workflows cross-platform.
• Use approved tooling to accelerate investigations and documentation.
• Contribute through GitHub with PRs and tests.
• Instrument workflows with telemetry for observability.
• Apply safety controls for consequential actions.
• Communicate incidents and risk clearly to leadership.

Skills

DFIR

Endpoint forensics

Python

Git/GitHub

AI tooling familiar

Agent workflow design

Observability

Tools

Claude

Codex

Copilot

GitHub

Job description

Sophos is seeking a highly capable security engineer to independently detect, investigate and respond to cyber threats while engineering scalable detections and agentic workflows. You will use AI-assisted tools and production-grade automation to improve incident response effectiveness.

The role emphasizes DFIR, threat hunting and cross-functional collaboration across engineering, product and leadership to reduce risk and improve resilience.