Security Engineer (Threat Response), Sophos Security Team (IDR)

Jobgether SRL; United States; Remote; USD 60,000 - 100,000; Full time

Benefits offered by this job

Remote-first working model

Diversity and inclusion networks

Wellbeing days

Charity initiatives

Global sustainability initiatives

Comprehensive benefits package

Job summary

Jobgether SRL is seeking an experienced security engineer to blend incident response with proactive security engineering. You will investigate threats, improve detection, automate repetitive tasks, and build observable, repeatable workflows for security teams.

The role requires enterprise IR across endpoints, identity, cloud, and network, plus DFIR, threat hunting, and automation using Python and APIs. You will contribute to GitHub workflows, design observability, and ensure safe AI-assisted

Qualifications

• Strong enterprise incident response experience across endpoint, identity, cloud, network, and product investigations.
• Practical DFIR, endpoint and firewall forensics, threat hunting, detection engineering.
• Ability to develop reliable automation using Python or similar.
• Experience with APIs and SQL data querying.
• Familiarity with Git and GitHub workflows (PRs, reviews, CI/CD).
• Hands-on with coding agents: Claude, Codex, Copilot or equivalents.
• Understanding AI safety, context design, task decomposition, evaluation of AI outputs.

Responsibilities

• Lead complex investigations through the incident lifecycle, from triage to lessons learned.
• Coordinate response across detection, engineering, product, and business teams.
• Develop and improve detections, playbooks, orchestrations, and prevention mechanisms.
• Build production-quality automation to reduce repetitive work and boost analyst capacity.
• Design reusable, model-agnostic skills and workflows for AI and agent platforms.
• Instrument workflows with logs, traces, metrics, and evaluation results.

Skills

Incident response

Security engineering

Python automation

API usage

Git/GitHub workflows

AI/automation safety

Observability design

Tools

GitHub

SQL

CI/CD

Claude

Codex/Copilot

Job description

Accountabilities:

You will combine incident response expertise with practical security engineering to investigate threats, improve detection capabilities, automate repetitive work, and build reliable, observable workflows that help security teams respond more effectively.

• Lead complex investigations throughout the incident lifecycle, from triage and evidence collection through containment, recovery, and lessons learned.
• Act as a trusted point of contact for security issues, coordinating response across incident detection and response, engineering, product, and business teams.
• Conduct DFIR and endpoint forensics, including log, network, and packet analysis, malware analysis, and firewall investigations where applicable.
• Develop and improve detections, playbooks, orchestrations, and prevention mechanisms using evidence from incidents and threat-hunting activities.
• Build production-quality automation that reduces repetitive work, improves consistency, and enables analysts to focus on higher-value activities.
• Design reusable, model-agnostic skills and workflows that can operate across approved AI and agent platforms.
• Use AI-assisted development and investigation tools to accelerate coding, testing, documentation, investigations, and detection engineering.
• Contribute to GitHub-based engineering workflows, including branching, pull requests, code reviews, testing, feedback cycles, and controlled deployments.
• Instrument agentic workflows with logs, traces, metrics, evaluation results, and failure signals to ensure behavior and outcomes remain observable.
• Apply secure harness design, least-privilege principles, scoped tool access, approval gates, evidence validation, rollback mechanisms, and human review for consequential actions.
• Communicate incidents, risks, technical decisions, and outcomes clearly to engineering teams and leadership.
• Continuously improve security processes and engineering practices based on incident findings, threat intelligence, operational data, and lessons learned.

Requirements

You bring strong enterprise incident response and security engineering experience, combined with practical development capabilities and an understanding of how automation and AI can be applied safely to security operations.

• Strong enterprise incident response experience across endpoint, identity, cloud, network, and product-focused investigations.
• Practical experience with DFIR, endpoint and firewall forensics, threat hunting, detection engineering, and analysis of unstructured telemetry.
• Ability to develop reliable automation using Python or a comparable programming language.
• Experience working with APIs and querying data using SQL.
• Working knowledge of Git and GitHub engineering practices, including pull requests, code reviews, testing, and CI/CD concepts.
• Hands-on familiarity with Claude, Codex, Copilot, or comparable coding-agent technologies.
• Understanding of context design, task decomposition, and validation of AI-generated output.
• Ability to design and write evaluations for agentic workflows and reusable skills, covering task success, output quality, safety, regressions, and common failure modes.
• Understanding of agent architecture, tool usage, skill-based design, model portability, and AI or automation safety controls.
• Ability to design observability for automated workflows and use telemetry to troubleshoot, measure quality, and improve reliability.
• Strong written and verbal communication skills.
• Sound operational security judgment and attention to safe handling of security-sensitive activities.
• Ability to work effectively within a globally coordinated and distributed environment.
• Legal authorization to work in Canada without requiring employer sponsorship.

Benefits

• Base salary ranging from $86,000 to $143,000 CAD .
• Additional compensation, including bonus eligibility .
• Comprehensive employee benefits package.
• Remote-first working model, with remote work serving as the primary option for most employees.
• Employee-led diversity and inclusion networks focused on community, education, and advocacy.
• Annual charity, fundraising, and employee volunteer initiatives.
• Global sustainability initiatives supporting efforts to reduce environmental impact.
• Global fitness and trivia activities supporting employee connection and wellbeing.
• Global wellbeing days designed to provide time to relax and recharge.
• Monthly wellbeing webinars and training focused on employee health and wellbeing.
• Inclusive environment that values diverse perspectives, collaboration, innovation, and continuous learning.
• Opportunity to work at the intersection of incident response, threat intelligence, detection engineering, automation, and responsible AI adoption.
• Recruitment and selection accommodations available to support candidates who require adjustments.