1 year ago
Responsibilities
- Develop countermeasures for advanced threats using research and intelligence from the CTU team.
- Analyze endpoint behavior and logs to design detections using telemetry from multiple sources.
- Continuously refine and monitor detection rules to improve alert signal-to-noise ratio.
- Research and implement alert handling for new device ingestions.
- Use internal tooling to distinguish native integrations from standard integrations for detection accuracy.
- Contribute to internal tools, automation, and detection infrastructure.
- Serve as a subject matter expert for Product Management, Marketing, and Labs Research.
Requirements
- Hands-on experience with PowerShell, Bash, Python, and Python data science libraries such as NumPy, Pandas, and Matplotlib.
- Knowledge of CI/CD pipelines, testing frameworks, and automation principles.
- Proficiency analyzing firewall, proxy, and security infrastructure logs to identify anomalies.
- Experience with static and dynamic malware analysis and reverse engineering of IA32/64 and ARM binaries.
- Experience performing forensic analysis of memory and disk images across multiple operating systems and file systems.
- Familiarity with event logs, traffic-pattern anomalies, and threat hunting methodologies.
- Strong understanding of endpoint detection, Linux/Unix and Windows internals, vulnerability identification, and workflow automation.
- Experience with event correlation and incident reconstruction using log data is preferred.
- Network traffic analysis skills, including identifying anomalous or malicious traits, are preferred.
- Knowledge of database querying, systems architecture, and process automation is desirable.
- Strong passion for cybersecurity research and ability to learn emerging technologies quickly.
Benefits
- Remote-first working model, with hybrid work possible for some roles.
- Employee-led diversity and inclusion networks.
- Annual charity, fundraising, and volunteer days.
- Global sustainability initiatives.
- Fitness and trivia competitions.
- Global wellbeing days, webinars, and health training.
About Sophos
Sophos, a global cybersecurity leader, defends more than 625,000 organizations worldwide with Sophos Fusion, the industry's first and most complete AI-native cybersecurity defense system: a single, connected architecture where every control point operates as one. Powered by agentic AI and elite human expertise, Sophos detects, investigates, and neutralizes threats before they become business-disrupting events. Working alongside a global ecosystem of managed service providers, resellers, and technology partners, Sophos compounds intelligence from every threat encountered and every environment defended to make every customer's defense stronger than the last. More information is available at www.sophos.com.