Remote Senior Incident Response Analyst, MDR

About Us
Sophos is a cybersecurity leader defending 600,000 organizations globally with an AI-driven platform and expert-led services. Sophos meets organizations wherever they are in their security maturity and grows with them to defeat cyberattacks. Its solutions combine machine learning, automation, and real-time threat intelligence with frontline human expertise from Sophos X-Ops to deliver advanced, 24/7 threat monitoring, detection, and response.

Sophos offers industry-leading managed detection and response (MDR) alongside a comprehensive portfolio of cybersecurity technologies — including endpoint, network, email, and cloud security, extended detection and response (XDR), identity threat detection and response (ITDR), and next-gen SIEM. Together with expert advisory services, these capabilities help organizations proactively reduce risk and respond faster, with the visibility and scalability needed to stay ahead of evolving threats.

Sophos goes to market with a global partner ecosystem, including Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), resellers and distributors, marketplace integrations, and cyber risk partners, giving organizations the flexibility to choose trusted relationships when securing their business. Sophos is headquartered in Oxford, U.K. More information is available at

Role Summary
Sophos is seeking a highly skilled Senior Incident Response Analyst to support Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT).

As a Senior Incident Response Analyst 2, you will lead complex and high-impact incident response engagements, operating across Responder, Advisor, and Commander roles as required. You are trusted to provide advanced technical leadership, shape investigative strategy, guide containment decisions, and ensure high-quality customer outcomes during critical security incidents.

What You Will Do

Lead complex investigations involving advanced adversaries, multi-vector intrusions, or cross-environment compromise

Serve as the primary Incident Advisor or delegated Commander for high-severity engagements

Direct and coordinate investigative, forensic, and containment activities across multiple analysts

Define engagement strategy, investigative priorities, and containment approaches based on risk and impact

Validate and synthesize technical findings into clear, actionable guidance for customers and internal stakeholders

Provide technical mentorship and oversight to IR and SOC analysts

Collaborate closely with SOC, Threat Intelligence, and Detection Engineering teams to validate detections and close visibility gaps

Lead or contribute to post-incident reviews, driving improvements to playbooks, tools, and response workflows

Maintain accurate time and activity tracking to support operational visibility and capacity planning

What You Will Bring
Essential:

5+ years of experience in incident response, MDR, or cyber security investigations, including leadership of complex incidents

Advanced expertise in endpoint and network forensics, log analysis, and adversary tradecraft

Strong understanding of enterprise network architecture and IT infrastructure

Proven ability to lead investigations, validate findings, and design effective containment strategies

Experience communicating technical findings to customers, including senior and executive stakeholders

Demonstrated mentorship and leadership across incident response teams

Ability to operate effectively under high‑pressure, time‑sensitive conditions

Willingness to work some weekends and holidays as part of a rotation

Desired:

Advanced incident response or forensic certifications (GCFA, GCED, GCIH, OSCP, or equivalent)

Experience acting as Incident Advisor or Commander during…