Threat Analyst II — MDR Threat Hunter & Incident Response

Sophos; United States; Remote; USD 90,000 - 125,000; Full time

Benefits offered by this job

Remote-first

Job summary

Sophos is seeking a Threat Analyst - Tier II to join our Managed Detection and Response (MDR) team. You will provide monitoring, detection, and proactive response to defend customer environments, collaborating with threat hunters, incident responders, and engineers across global teams.

You will handle end-to-end investigations, threat hunting, phishing and malware analysis, and case documentation while contributing to improving detection capabilities and playbooks in a remote-first, 24x7

Qualifications

• 2+ years in a SOC, MDR, or cybersecurity-focused IT role.
• Proficient with endpoint and network security tools to validate and triage alerts.
• Windows, Linux, macOS operating systems awareness.
• Interpretation of Windows event logs and telemetry data.
• Understanding of TCP/IP, routing, and traffic analysis.
• Experience in real-time incident response and threat investigations.
• Exposure to threat hunting methods and attacker behavior patterns.
• Active threat handling including containment and recovery during incidents.
• Familiar with persistence, privilege escalation, lateral movement, defense evasion.
• Familiar with standard IR workflows and security operations processes.
• Strong analytical and troubleshooting skills with thorough investigations and case docs.
• Excellent communication to explain findings to technical and non-technical audiences.
• Customer-first mindset and teamwork orientation.
• Willingness to learn in a fast-changing threat landscape.
• Bachelor’s degree or equivalent practical experience.
• Ability to communicate in English.

Responsibilities

• Monitor, investigate, and respond to alerts from the Sophos security stack (EDR/XDR).
• Lead and mentor Tier I Analysts through escalated cases and ensure thorough investigations.
• Perform end-to-end analysis on suspicious activity to assess scope and risk.
• Identify and respond to threats across customer environments using playbooks and tooling.
• Document findings and investigative steps in the MDR case management platform.
• Conduct threat hunting across the MDR customer base.
• Investigate phishing emails, suspicious binaries, and behavioral anomalies.
• Support detection tuning by reducing recurring false positives.
• Stay informed on MITRE ATT&CK techniques and Sophos threat research updates.
• Research emerging IOCs, exploits, and vulnerabilities to stay ahead.
• Contribute to knowledge bases, docs, and improvement initiatives.
• Participate in shift rotations and ensure detailed handovers between teams.
• Provide detection and response support for active incidents.
• Manage case workflows: create cases, track progress, follow up with clients.
• Engage with clients via chat, phone, and tickets as part of case handling.
• Assist in developing and refining SOC processes, playbooks, and tooling feedback.

Skills

SOC

MDR

EDR/IDS

Windows

Linux/macOS

Threat hunting

Incident response

Threat analysis

Documentation

Communication

Team player

English

Education

Bachelor's degree in IT/CS/Cybersecurity

Tools

EDR

IDS/IPS

Malware detection

SIEM

OSQuery

PowerShell

SQL queries

Job description

Sophos is seeking a Threat Analyst - Tier II to join our Managed Detection and Response (MDR) team. You will provide monitoring, detection, and proactive response to defend customer environments, collaborating with threat hunters, incident responders, and engineers across global teams.

You will handle end-to-end investigations, threat hunting, phishing and malware analysis, and case documentation while contributing to improving detection capabilities and playbooks in a remote-first, 24x7