7 days ago
Responsibilities
- Lead kick-off calls with customers to assess their situation and determine initial response actions.
- Provide guidance on best practices following an incident.
- Conduct daily update calls to deliver forensic findings to customers.
- Write clear and concise Executive Summary reports in a timely manner.
- Direct forensic investigations and delegate tasks to analysts.
- Manage multiple Rapid Response incidents concurrently.
- Determine TTPs identified by analysts and update the threat intel platform.
- Provide daily handover notes to teams in different time zones.
Requirements
- 5+ years of experience leading incident response investigations involving ransomware.
- Experience leading BEC investigations.
- Strong understanding of the Incident Response process and cyber risks.
- Excellent oral and written communication skills.
- Ability to manage time effectively and prioritize tasks.
- Strong grasp of the MITRE ATT&CK framework.
- Post-secondary education in Cybersecurity or a comparable field.
- Willingness to work on weekends and holidays.
Benefits
- Remote-first working model with flexibility for hybrid roles.
- Employee-led diversity and inclusion networks.
- Annual charity initiatives and volunteer days.
- Global employee sustainability initiatives.
- Wellbeing days and monthly health webinars.
About Sophos
Sophos, a global cybersecurity leader, defends more than 625,000 organizations worldwide with Sophos Fusion, the industry's first and most complete AI-native cybersecurity defense system: a single, connected architecture where every control point operates as one. Powered by agentic AI and elite human expertise, Sophos detects, investigates, and neutralizes threats before they become business-disrupting events. Working alongside a global ecosystem of managed service providers, resellers, and technology partners, Sophos compounds intelligence from every threat encountered and every environment defended to make every customer's defense stronger than the last. More information is available at www.sophos.com.