Sophos is seeking an entry-level Incident Response Analyst to support its Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT).
As an Incident Response Analyst 1, you will support investigative, forensic, and containment activities during active cyber incidents under the close supervision of senior analysts and Incident Advisors. You will serve in a supporting Incident Responder role focused on alert triage, evidence collection, and documentation. This role is the entry point into the CIRT and is designed to build the technical foundations needed to progress into more autonomous investigative work, with mentorship and guidance provided throughout.
Assist with investigative and forensic analysis across endpoints, network logs, and cloud telemetry under the direction of senior analysts
Support containment and response actions to neutralize active threats as directed by Incident Advisors or Senior Analysts
Triage and review alerts, indicators of compromise (IOCs), artifacts, and telemetry, escalating findings to senior analysts to help determine scope and root cause
Maintain clear and accurate engagement documentation, including trailheads, timelines, and playbooks
Develop incident response skills through hands-on engagements while following CIRT investigative and documentation standards
Contribute technical findings and summaries to support customer updates and post-incident reports
Identify and communicate detection or response gaps observed during investigations
Participate in shift handovers, debriefs, and post-incident reviews to ensure engagement continuity
Maintain accurate time and activity tracking to support operational visibility and service improvement
Essential:
1-2 years of experience in a SOC, MDR, or security operations role preferred; this is an entry point into incident response
Foundational technical understanding of endpoint security, log analysis, and common attack techniques
Familiarity with common threats such as malware, credential theft, and ransomware
Ability to review and triage alerts and telemetry, escalating to senior analysts as appropriate
Strong written and verbal communication skills for documenting findings and contributing to customer updates
Eagerness to learn and develop technical skills with guidance from senior analysts
Ability to work effectively in high-pressure, time-sensitive incident environments
Willingness to work some weekends and holidays as part of a rotation
Desired:
Exposure to EDR, SIEM, or forensic collection tools
Familiarity with OSQuery, SQL, or KQL
Knowledge of MITRE ATT&CK and incident response frameworks
Industry certifications such as CompTIA Security+, GFACT, GCIH, or equivalent
Interest in contributing to playbooks, detection tuning, or service improvement initiatives
Sophos is a cybersecurity leader defending 600,000 organizations globally with an AI-driven platform and expert-led services. Sophos meets organizations wherever they are in their security maturity and grows with them to defeat cyberattacks. Its solutions combine machine learning, automation, and real-time threat intelligence with frontline human expertise from Sophos X-Ops to deliver advanced, 24/7 threat monitoring, detection, and response.
Sophos offers industry-leading managed detection and response (MDR) alongside a comprehensive portfolio of cybersecurity technologies — including endpoint, network, email, and cloud security, extended detection and response (XDR), identity threat detection and response (ITDR), and next-gen SIEM. Together with expert advisory services, these capabilities help organizations proactively reduce risk and respond faster, with the visibility and scalability needed to stay ahead of evolving threats.
Sophos goes to market with a global partner ecosystem, including Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), resellers and distributors, marketplace integrations, and cyber risk partners, giving organizations the flexibility to choose trusted relationships when securing their business.
More information is available at www.sophos.com.
