Strategic Incident Response & Threat Intel Lead

Sophos; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Sophos is seeking an experienced Incident Response & Threat Intelligence Lead to support clients facing sophisticated security threats. You will lead investigations, containment, and response across Windows, Mac, and Linux, while enriching findings with the latest attacker TTP intelligence.

You will translate operational insights into actionable guidance for clients and internal teams. You will also act as a key liaison with Sophos Counter Threat Unit, delivering high quality technical and

Qualifications

• Lead investigations, containment and response to incidents across platforms (Windows, Mac, Linux).
• Translate threat intelligence into actionable client guidance and remediation plans.
• Present findings to executives and technical staff with clear, data-driven recommendations.
• Display strong leadership under pressure and coordinate with internal teams.

Responsibilities

• Lead assigned engagements to investigate, contain and respond to incidents.
• Coordinate communications with customer senior stakeholders and internal teams.
• Utilize threat intelligence to inform investigations and tooling improvements.
• Deliver high-quality written and verbal reports to clients and management.

Skills

Incident response leadership

Threat intelligence

Executive communication

Cross-functional collaboration

Investigation & root cause analysis

TTPs analysis (MITRE ATT&CK)

Education

Bachelor's degree in CS/IR or related

Security certifications (GCIH/GCFA/GCFE)

Tools

EnCase/FTK/X-Ways

Microsoft 365 forensics

AWS forensics

EDR tooling (Sophos and others)

Job description

Sophos is seeking an experienced Incident Response & Threat Intelligence Lead to support clients facing sophisticated security threats. You will lead investigations, containment, and response across Windows, Mac, and Linux, while enriching findings with the latest attacker TTP intelligence.

You will translate operational insights into actionable guidance for clients and internal teams. You will also act as a key liaison with Sophos Counter Threat Unit, delivering high quality technical and