Senior Incident Response Lead – MDR Focus (Remote)

Openkrill; United States; Remote; USD 90,000 - 130,000; Full time

Benefits offered by this job

Remote-first

Hybrid options

Wellbeing programs

Job summary

Sophos is seeking a Senior Incident Response Analyst to support MDR customers and MSPs within the Critical Incident Response Team (CIRT). You will lead investigations, contain threats, and guide remediation using Sophos technologies across diverse clients and countries.

The role emphasizes rapid decision-making, mentoring, and collaboration with internal teams to improve detection logic and response capabilities. Remote-first with possible hybrid requirements.

Qualifications

• 4+ years of cyber security investigations or 2+ years in incident response engagements
• Experience documenting technical findings for customers
• Knowledge of Windows, Linux, and macOS command/scripting basics
• Familiarity with MITRE ATT&CK and Cyber Kill Chain frameworks

Responsibilities

• Lead investigative execution of active cyber incidents for MDR customers and MSPs
• Mentor junior analysts with technical guidance and escalation support
• Identify initial access, persistence, and lateral movement to contain threats
• Coordinate with customers via meetings/calls to discuss incidents and remediation
• Analyze incidents for malware, ransomware, and other attack types
• Maintain detailed documentation of analyses and actions taken
• Collaborate with SophosLabs and Threat Hunting to improve detections
• Contribute to blogs/socials with investigative findings
• Create technical incident reports for MDR customers and MSPs

Skills

Investigation

Threat hunting

IR tooling

Documentation

MITRE ATT&CK

Windows/Linux/macOS

Tools

EDR/IDS/IPS

Job description

Sophos is seeking a Senior Incident Response Analyst to support MDR customers and MSPs within the Critical Incident Response Team (CIRT). You will lead investigations, contain threats, and guide remediation using Sophos technologies across diverse clients and countries.

The role emphasizes rapid decision-making, mentoring, and collaboration with internal teams to improve detection logic and response capabilities. Remote-first with possible hybrid requirements.