Threat Analyst

Role Summary

As a Threat Analyst - Tier II on our Managed Detection and Response (MDR) team, you will provide best-in-class monitoring, detection, and response services to proactively defend customer environments before attacks prevail. You will work alongside and contribute to a team of cyber threat hunters, incident response analysts, engineers, and ethical hackers by using enterprise, log analysis and endpoint collection systems to facilitate investigations, identification, and neutralization of cyber threats.

• Investigate and analyze logs and security-related events via Sophos tooling
• Handle escalations from Tier I Threat Analysts - guide / advise on investigation handling
• Onboard and train new Threat Analysts
• Create cases, track and follow up with clients through threat neutralization
• Communicate and document findings to various customer audiences including technical and executive teams
• Follow up with customers through to issue resolution and drive continuous improvement by providing detailed recommendations to minimize risk in customer environments
• Acknowledge and satisfy inbound customer requests and interact with customers through various mediums (Email, Phone, Ticket)
• Collaborate and assist with core security and threat response teams
• Actively research emerging Indicators of Compromise/Attack, exploits and vulnerabilities
• Conduct threat hunting to identify potential threats throughout the MDR customer base
• Participate in Security Operations process improvement and creation
• Obtain metrics for reporting on threat trends, intelligence analysis and situational awareness

• 2+ years of experience working in a SOC environment or computer security team in an IT environment
• Endpoint and network security experience required; IDS, IPS, EDR, ATP, Malware defenses and monitoring experience
• Experience with threat hunting
• Experience administering and supporting Windows OS (workstations and server) and one of the following:
  Apple or Linux-based operating systems (Red Hat, Debian, Ubuntu, OS X)
• Knowledge of common adversary tactics and techniques, e.g., obfuscation, persistence, defense evasion, etc.
• Fundamental understanding of network traffic analysis including TCP/IP, routing, switching, protocols, etc.
• Strong understanding of Windows event log analysis
• Working knowledge of incident response procedures
• Passion for all things related to information technology and cybersecurity
• Natural curiosity and ability to learn new skills quickly
• Excellent troubleshooting and analytical skills, with proven ability to think outside the box
• Customer service-oriented with strong written and verbal communication skills
• Must thrive within a team environment as well as on an individual basis
• Innovative mindset and driven to contribute to a team providing a best-in-class cybersecurity service
• Bachelors in Information Technology, Computer Science or a related field; or relevant commensurate work experience
• Willingness to work outside of standard business days including weekends and holidays – our MDR service is 24x7x365 (Hours are standard business hours)

• Knowledge of MITRE ATT&CK framework
• Experience with SQL query construction
• Experience with OSQuery Programming and scripting skills - proficient knowledge of Power Shell
• Experience with enterprise information security data management - SIEM
• Advanced Cyber Security certifications

• Sophos operates a remote-first working model, making remote work the primary option for most employees. However, some roles may necessitate a hybrid approach. While we are a remote first organization, applicants must have legal authorization to work in the jurisdiction where the position is posted, without requiring employer sponsorship.
• Our people – we innovate and create, all of which are accompanied by a great sense of fun and team spirit.
• Employee-led diversity and inclusion networks that build community and provide education and advocacy.
• Annual charity and fundraising initiatives and volunteer days for employees to support local communities.
• Global employee sustainability initiatives to reduce our environmental footprint.
• Global fitness and trivia competitions to…