Sophos is seeking an entry-level Incident Response Analyst to support its Managed Detection and Response (MDR) customers within the Critical Incident Response Team (CIRT).
As an Incident Response Analyst 1, you will support investigative, forensic, and containment activities during active cyber incidents under the close supervision of senior analysts and Incident Advisors. You will serve in a supporting Incident Responder role focused on alert triage, evidence collection, and documentation. This role is the entry point into the CIRT and is designed to build the technical foundations needed to progress into more autonomous investigative work, with mentorship and guidance provided throughout.
Assist with investigative and forensic analysis across endpoints, network logs, and cloud telemetry under the direction of senior analysts
Support containment and response actions to neutralize active threats as directed by Incident Advisors or Senior Analysts
Triage and review alerts, indicators of compromise (IOCs), artifacts, and telemetry, escalating findings to senior analysts to help determine scope and root cause
Maintain clear and accurate engagement documentation, including trailheads, timelines, and playbooks
Develop incident response skills through hands-on engagements while following CIRT investigative and documentation standards
Contribute technical findings and summaries to support customer updates and post-incident reports
Identify and communicate detection or response gaps observed during investigations
Participate in shift handovers, debriefs, and post-incident reviews to ensure engagement continuity
Maintain accurate time and activity tracking to support operational visibility and service improvement
Essential:
1-2 years of experience in a SOC, MDR, or security operations role preferred; this is an entry point into incident response
Foundational technical understanding of endpoint security, log analysis, and common attack techniques
Familiarity with common threats such as malware, credential theft, and ransomware
Ability to review and triage alerts and telemetry, escalating to senior analysts as appropriate
Strong written and verbal communication skills for documenting findings and contributing to customer updates
Eagerness to learn and develop technical skills with guidance from senior analysts
Ability to work effectively in high-pressure, time-sensitive incident environments
Willingness to work some weekends and holidays as part of a rotation
Desired:
Exposure to EDR, SIEM, or forensic collection tools
Familiarity with OSQuery, SQL, or KQL
Knowledge of MITRE ATT&CK and incident response frameworks
Industry certifications such as CompTIA Security+, GFACT, GCIH, or equivalent
Interest in contributing to playbooks, detection tuning, or service improvement initiatives
Sophos
May Mobility
Accenture Nordics
Accenture
PlanIT Group, LLC
Sophos
Sophos
Sophos
