Senior Incident Response Analyst

• Lead investigative execution of active cyber incidents for MDR customers and MSPs
• Use Sophos technologies to investigate, contain, and respond to cyber incidents
• Perform advanced incident response analysis to identify initial access, persistence, and lateral movement
• Mentor incident response analysts and MDR operations analysts through technical guidance, review, and escalation support
• Support customers and MSPs through phone calls and meetings about cyber incidents
• Provide recommendations to contain, neutralize, and remediate threats
• Analyze malware, ransomware, and other common attack types
• Maintain accurate and detailed incident analysis documentation
• Collaborate with SophosLabs, Detection Engineering, Threat Hunting, and MDR Operations teams
• Contribute, where appropriate, to Sophos blogs, social media, and other sources on adversary TTPs and IOCs
• Evaluate technologies and processes to improve incident response capability
• Create technical incident reports as post-incident deliverables for MDR customers and MSPs

• 4+ years of experience conducting cybersecurity investigations and investigating threats, or 2+ years of experience performing incident response engagements
• Understanding of network architecture and IT infrastructure
• Experience creating technical documentation and technical reports for customers
• Ability to work under high-pressure situations when response time matters
• Network and endpoint investigation experience across macOS, Linux, and Windows
• Experience with IDS, IPS, EDR, and basic malware analysis
• Understanding of at least one of OSQuery, SQL, or KQL
• Experience applying frameworks such as MITRE Attack and Cyber Kill Chain
• Ability to work some weekends and holidays
• Knowledge of Windows and Linux command and script interpreters
• Legal authorization to work in India without requiring employer sponsorship
• Advanced cybersecurity certifications such as GCFE/GCFA, CompTIA CySA+, or OSCP are desired
• Experience calling customers and providing excellent customer service is desired
• Cybersecurity publications are desired

• Remote-first working model
• Employee-led diversity and inclusion networks
• Annual charity and fundraising initiatives
• Volunteer days
• Global employee sustainability initiatives
• Global fitness and trivia competitions
• Global wellbeing days
• Monthly wellbeing webinars and training
• Recruitment adjustments to support applicants with disabilities or other needs