Remote Incident Response Lead (CIRT/MDR)

sophos; United States; Remote; USD 150,000 - 210,000; Full time

Job summary

Sophos seeks an experienced Incident Response Manager to lead the CIRT within its MDR offerings. You will oversee squads of analysts, balance people leadership with incident response operations, and act as Incident Commander for high-severity engagements, driving improvements and customer outcomes.

You will collaborate across Threat Intelligence, SOC, and Product teams to close detection gaps, maintain playbooks, and ensure continuous readiness in a fast-changing threat landscape.

Qualifications

• 7+ years in cybersecurity operations or related field, with at least 2 years leading people.
• Experience managing incident response operations across multiple concurrent engagements.
• Strong technical background in endpoint, network, and cloud security; ability to direct containment, eradication, and remediation.
• Experience as Incident Commander or senior technical escalation point during high-pressure incidents.
• Proven people-leadership experience including coaching, performance management, hiring, and onboarding.
• Experience using operational metrics, quality reviews, and customer feedback to drive improvements in security operations.
• Understanding of attacker tools, MITRE ATT&CK framework; active curiosity and continuous learning.
• Excellent written and verbal communication, analytical skills; degree in IT/CS or equivalent experience.
• Advanced cybersecurity certifications preferred.
• Experience leading distributed, global, or 24x7 incident response teams; on-call leadership.
• Familiarity with SIEM, EDR, forensic tools, and related platforms.

Responsibilities

• Lead and develop squads of analysts across CIRT; set expectations, coach, and drive a high-performing team culture.
• Own day-to-day CIRT operations across multiple squads, including staffing, coverage, workload balancing, and SLAs.
• Provide senior technical leadership and act as Incident Commander for complex/high-severity engagements; coordinate investigation and customer communications.
• Establish and maintain operational and investigative quality standards; ensure documentation, case reviews, and post-incident actions are complete.
• Use engagement, quality, and outcome metrics to identify trends and drive improvements across the function.
• Build operational readiness with training plans, incident exercises, and tooling updates.
• Serve as senior escalation point for customer concerns and translate technical updates for technical and executive stakeholders.
• Partner with Threat Intelligence, SOC, Detection Engineering, Product, and others to close gaps and strengthen MDR capabilities.
• Drive continuous improvement and standardization through lessons learned and automation opportunities.

Skills

Incident response leadership

Team management

Threat intelligence collaboration

Incident Commander

Security operations

Endpoint security

MITRE ATT&CK knowledge

Communication skills

Education

Bachelor's degree in Information Technology or Computer Science

Advanced cybersecurity certifications (GCFE/GCFA/GCIH/CISSP)

Tools

SIEM

EDR

Velociraptor

OSQuery

PowerShell

KQL

SQL

Job description

Sophos seeks an experienced Incident Response Manager to lead the CIRT within its MDR offerings. You will oversee squads of analysts, balance people leadership with incident response operations, and act as Incident Commander for high-severity engagements, driving improvements and customer outcomes.

You will collaborate across Threat Intelligence, SOC, and Product teams to close detection gaps, maintain playbooks, and ensure continuous readiness in a fast-changing threat landscape.