Threat Analyst I — 24/7 Remote MDR Defender

Sophos; United States; Remote; USD 70,000 - 110,000; Full time

Benefits offered by this job

Remote-first

Job summary

Sophos is seeking a Threat Analyst 1 for its MDR team to provide monitoring, detection, and response services to proactively defend customer environments. You will work with threat hunters, incident responders, and engineers using enterprise tools to investigate and neutralize threats.

We require at least 2 years in a SOC or security context, knowledge of MITRE ATT&CK, incident response, and Windows/Linux administration.

Qualifications

• Minimum 2+ years of experience working in a SOC environment or computer security team in an IT environment.
• Experience with threat hunting.
• Experience with endpoint and network security monitoring.
• Experience administering and supporting Windows OS (workstations and servers) and one of: Apple or Linux-based OS.
• Knowledge of MITRE ATT&CK framework.
• Knowledge of incident response procedures.
• Basic understanding of network traffic analysis including TCP/IP, routing, switching, protocols.
• Basic understanding of Windows event log analysis.
• Nice to have: Experience with SQL query construction, OSQuery, SIEM data management.
• Proficiency in PowerShell scripting.

Responsibilities

• Investigate and analyze logs and security events using Sophos tooling.
• Identify and respond to cyber threats within customer environments.
• Communicate findings to technical and executive audiences.
• Follow up through issue resolution and provide recommendations to minimize risk.
• Acknowledge and manage inbound customer requests across mediums.
• Collaborate with core security and threat response teams.
• Research emerging threats and operationalize findings to improve protection.

Skills

SOC monitoring

Threat hunting

Endpoint security

Windows OS

Linux OS

Tools

SIEM tools

OSQuery

SQL queries

Job description

Sophos is seeking a Threat Analyst 1 for its MDR team to provide monitoring, detection, and response services to proactively defend customer environments. You will work with threat hunters, incident responders, and engineers using enterprise tools to investigate and neutralize threats.

We require at least 2 years in a SOC or security context, knowledge of MITRE ATT&CK, incident response, and Windows/Linux administration.