Incident Response Analyst 2: MDR & Forensic Investigator

Sophos; United States; Remote; USD 85,000 - 120,000; Full time

Benefits offered by this job

Remote-first

Flexible schedule

Job summary

Sophos is seeking an intermediate-level Incident Response Analyst to support its MDR customers within the Critical Incident Response Team (CIRT). The role involves advanced investigative and containment activities, operating with moderate autonomy, and mentoring junior analysts to ensure quality and consistency.

We operate a remote-first model; some roles may require a hybrid approach. Applicants must have legal authorization to work in the posting jurisdiction without sponsorship.

Qualifications

• 2+ years in incident response, MDR, SOC, or security operations roles.
• Strong knowledge of endpoint forensics, log analysis, and attack techniques.
• Experience investigating malware, credential theft, ransomware, or similar threats.

Responsibilities

• Perform advanced investigative and forensic analysis across endpoints, network logs, and cloud telemetry.
• Execute containment and response actions to neutralize active threats as directed by senior staff.
• Validate indicators of compromise (IOCs) and determine scope and root cause.

Skills

2+ years IR

Endpoint forensics

Malware analysis

Incident scope & root cause

Documentation & reporting

Education

GCIH / GCED / Security+

Bachelor's in CS/IS or equivalent

Tools

EDR

SIEM

Forensic tools

OSQuery

SQL / KQL

Job description

Sophos is seeking an intermediate-level Incident Response Analyst to support its MDR customers within the Critical Incident Response Team (CIRT). The role involves advanced investigative and containment activities, operating with moderate autonomy, and mentoring junior analysts to ensure quality and consistency.

We operate a remote-first model; some roles may require a hybrid approach. Applicants must have legal authorization to work in the posting jurisdiction without sponsorship.