Senior Incident Response Analyst, MDR

About Us
Sophos is a cybersecurity leader defending 600,000 organizations globally with an AI-driven platform and expert-led services. Sophos meets organizations wherever they are in their security maturity and grows with them to defeat cyberattacks. Its solutions combine machine learning, automation, and real-time threat intelligence with frontline human expertise from Sophos X-Ops to deliver advanced, 24/7 threat monitoring, detection, and response.

Sophos offers industry-leading managed detection and response (MDR) alongside a comprehensive portfolio of cybersecurity technologies — including endpoint, network, email, and cloud security, extended detection and response (XDR), identity threat detection and response (ITDR), and next-gen SIEM. Together with expert advisory services, these capabilities help organizations proactively reduce risk and respond faster, with the visibility and scalability needed to stay ahead of evolving threats.

Sophos goes to market with a global partner ecosystem, including Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), resellers and distributors, marketplace integrations, and cyber risk partners, giving organizations the flexibility to choose trusted relationships when securing their business. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.

Role Summary
Sophos is seeking a highly skilled Senior Incident Response Analyst to support Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT).
As a Senior Incident Response Analyst 2, you will lead complex and high-impact incident response engagements, operating across Responder, Advisor, and Commander roles as required. You are trusted to provide advanced technical leadership, shape investigative strategy, guide containment decisions, and ensure high-quality customer outcomes during critical security incidents.

What You Will Do
- Lead complex investigations involving advanced adversaries, multi-vector intrusions, or cross-environment compromise

- Serve as the primary Incident Advisor or delegated Commander for high-severity engagements

- Direct and coordinate investigative, forensic, and containment activities across multiple analysts

- Define engagement strategy, investigative priorities, and containment approaches based on risk and impact

- Validate and synthesize technical findings into clear, actionable guidance for customers and internal stakeholders

- Provide technical mentorship and oversight to IR and SOC analysts

- Collaborate closely with SOC, Threat Intelligence, and Detection Engineering teams to validate detections and close visibility gaps

- Lead or contribute to post-incident reviews, driving improvements to playbooks, tools, and response workflows

- Maintain accurate time and activity tracking to support operational visibility and capacity planning

What You Will Bring
Essential:

- 5+ years of experience in incident response, MDR, or cyber security investigations, including leadership of complex incidents

- Advanced expertise in endpoint and network forensics, log analysis, and adversary tradecraft

- Strong understanding of enterprise network architecture and IT infrastructure

- Proven ability to lead investigations, validate findings, and design effective containment strategies

- Experience communicating technical findings to customers, including senior and executive stakeholders

- Demonstrated mentorship and leadership across incident response teams

- Ability to operate effectively under high-pressure, time-sensitive conditions

- Willingness to work some weekends and holidays as part of a rotation

Desired:

- Advanced incident response or forensic certifications (GCFA, GCED, GCIH, OSCP, or equivalent)

- Experience acting as Incident Advisor or Commander during critical engagements

- Publications, presentations, or recognized contributions within the cybersecurity field

- Experience influencing detection strategy, tooling improvements, or service design

- Strong customer-facing presence with experience briefing executives during incidents