Senior MDR Incident Response Lead

Sophos; Oxford; Remote; CAD 131,000 - 219,000; Full time

Job summary

Sophos is seeking a Senior Incident Response Analyst to support MDR customers within the Critical Incident Response Team. You will lead high‑impact incidents across Responder, Advisor, and Commander roles, guiding strategy and ensuring excellent customer outcomes.

In Canada, the base salary ranges CAD 131,000 to 219,000, with bonus eligibility and a comprehensive benefits package. Remote‑first work is offered, with occasional on‑site requirements and opportunities to mentor IR/SOC teams.

Qualifications

• 5+ years in incident response, MDR, or cyber security investigations with leadership of complex incidents
• Advanced expertise in endpoint and network forensics, log analysis, and adversary tradecraft
• Strong understanding of enterprise network architecture and IT infrastructure
• Proven ability to lead investigations, validate findings, and design effective containment strategies
• Experience communicating technical findings to customers, including senior and executive stakeholders
• Demonstrated mentorship and leadership across incident response teams
• Ability to operate effectively under high‑pressure, time‑sensitive conditions
• Willingness to work some weekends and holidays as part of a rotation

Responsibilities

• Lead complex investigations involving advanced adversaries, multi‑vector intrusions, or cross‑environment compromise
• Serve as the primary Incident Advisor or delegated Commander for high‑severity engagements
• Direct and coordinate investigative, forensic, and containment activities across multiple analysts
• Define engagement strategy, investigative priorities, and containment approaches based on risk and impact
• Validate and synthesize technical findings into clear, actionable guidance for customers and internal stakeholders
• Provide technical mentorship and oversight to IR and SOC analysts
• Collaborate closely with SOC, Threat Intelligence, and Detection Engineering teams to validate detections and close visibility gaps
• Lead or contribute to post‑incident reviews, driving improvements to playbooks, tools, and response workflows
• Maintain accurate time and activity tracking to support operational visibility and capacity planning

Skills

Incident response leadership

Endpoint forensics

Network forensics

Log analysis

Executive communication

Mentorship

High-pressure decision making

Education

GCFA/GCED/GCIH/OSCP or equivalent certifications

Job description

Sophos is seeking a Senior Incident Response Analyst to support MDR customers within the Critical Incident Response Team. You will lead high‑impact incidents across Responder, Advisor, and Commander roles, guiding strategy and ensuring excellent customer outcomes.

In Canada, the base salary ranges CAD 131,000 to 219,000, with bonus eligibility and a comprehensive benefits package. Remote‑first work is offered, with occasional on‑site requirements and opportunities to mentor IR/SOC teams.