Incident Response Engineer 2
Key Skills for This Role
Full Job Posting
What You Will Do
- Perform advanced investigative and forensic analysis across endpoints, network logs, and cloud telemetry
- Execute containment and response actions to neutralize active threats as directed by Incident Advisors or Senior Analysts
- Validate indicators of compromise (IOCs) and correlate alerts, artifacts, and telemetry to determine scope and root cause
- Maintain clear and accurate engagement documentation, including trailheads, timelines, and playbooks
- Provide guidance and mentorship to junior IR and SOC analysts to ensure adherence to CIRT investigative and documentation standards
- Prepare technical findings and summaries for inclusion in customer updates and post-incident reports
- Identify and communicate detection or response gaps observed during investigations
- Participate in shift handovers, debriefs, and post-incident reviews to ensure engagement continuity
- Maintain accurate time and activity tracking to support operational visibility and service improvement
What You Will Bring
Essential:
2+ years of experience in incident response, MDR, SOC, or security operations roles
Solid technical understanding of endpoint forensics, log analysis, and common attack techniques
Experience investigating malware, credential theft, ransomware, or similar threats
Ability to correlate alerts and telemetry to determine incident scope and root cause
Strong written and verbal communication skills for documenting findings and contributing to customer updates
Experience mentoring or guiding junior analysts
Ability to work effectively in high-pressure, time-sensitive incident environments
Willingness to work some weekends and holidays as part of a rotation
Desired:
Hands-on experience with EDR, SIEM, and forensic collection tools
Familiarity with OSQuery, SQL, or KQL
Knowledge of MITRE ATT&CK and incident response frameworks
Industry certifications such as GCIH, GCED, CompTIA Security+, or equivalent
Experience contributing to playbooks, detection tuning, or service improvement initiatives
About Sophos
Sophos is a global cybersecurity company providing managed detection and response alongside endpoint, network, email, and cloud security technologies. Its AI-driven platform and expert-led services help organizations prevent, detect, and respond to cyberattacks.
Visit company websiteJobs and hiring trendsApply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer
More jobs at Sophos
Senior Product Manager, AI-Native Products
, CAN
About Us Sophos is a cybersecurity leader defending 600,000 organizations globally with an AI-driven platform and expert-led services. Sophos meets organizations wherever they are in their security maturity and grows wit
Senior Application Programming Developer
, USA
About Us Sophos is a cybersecurity leader defending 600,000 organizations globally with an AI-driven platform and expert-led services. Sophos meets organizations wherever they are in their security maturity and grows wit
Manager, Sales Development (1 year FTC)
Manchester, GBR
Senior HRIS Analyst (India/Philippines)
, IND
Senior Product Manager, AI-Native Products
, CAN
Field Marketing Intern – 12 Month Fixed Term Placement
, GBR
Manager, Threat Operations
, AUS
Senior Application Programming Developer
, USA
Senior Enterprise Account Executive
, USA
Senior Channel Account Executive
, IND