Senior Threat Analyst – Remote MDR Leader

Sophos; Oxford; Hybrid; CAD 86,000 - 143,000; Full time

Benefits offered by this job

Remote-first culture

Flexible work options

Job summary

Sophos seeks a Senior Threat Analyst – Tier I for its MDR team in Canada. You will monitor, investigate, and respond to alerts across the Sophos security stack, collaborating with threat hunters and incident responders to neutralize cyber threats.

This remote-first role requires 5+ years in SOC/MDR, strong experience with EDR/XDR, Windows/Linux, and threat hunting. The position offers 24x7 coverage and a comprehensive benefits package.

Qualifications

• 5+ years in a SOC/MDR or cybersecurity IT role.
• Proficient with endpoint and network security tools to validate and triage alerts.
• Working knowledge of Windows, Linux, and macOS environments.
• Ability to interpret Windows event logs and telemetry data.
• Familiar with MITRE ATT&CK framework and incident response workflows.

Responsibilities

• Monitor, investigate, and respond to alerts from the Sophos security stack (EDR/XDR).
• Lead and mentor Tier I Analysts through escalated cases and ensure thorough investigations.
• Perform end-to-end analysis on suspicious activity to assess scope, impact, and risk.
• Identify and respond to threats across customer environments using approved playbooks.
• Document findings and outcomes in the MDR case management platform.
• Conduct threat hunting to identify potential threats in the MDR base.
• Support detection tuning by reducing false positives and improving rules.

Skills

SOC/MDR experience

EDR/XDR tools

Windows & Linux

Threat analysis

Incident response

Communication skills

Education

Bachelor's in IT / CS / Cybersecurity

Tools

SIEM platforms

OSQuery

PowerShell

SQL queries

Job description

Sophos seeks a Senior Threat Analyst – Tier I for its MDR team in Canada. You will monitor, investigate, and respond to alerts across the Sophos security stack, collaborating with threat hunters and incident responders to neutralize cyber threats.

This remote-first role requires 5+ years in SOC/MDR, strong experience with EDR/XDR, Windows/Linux, and threat hunting. The position offers 24x7 coverage and a comprehensive benefits package.