Incident Response Analyst

• Utilize Sophos technologies to investigate, contain, and respond to cyber incidents
• Conduct analysis of cyber incidents for malware, ransomware, and other common attack types
• Maintain accurate and detailed documentation for analysis performed during cyber incidents
• Recognize and codify attacker tools, tactics, and procedures that can be applied to current and future investigations and tooling
• Provide clear and concise communication to MDR customers during cyber incidents
• Work closely with internal SophosLabs, Detection Engineering, and Threat Hunting teams to continuously expand and improve detection logic
• Work closely with Sophos MDR Operations teams in providing response, remediation guidance, and excellent customer service
• Assist in creating accurate and detailed technical incident reports as a post-incident deliverable for MDR customers and MSPs

Essential: 

• 3+ years of experience conducting cyber security investigations in a methodical manner and investigating threats
• Knowledge of incident response toolsets, methodologies, and techniques
• Experience creating technical documentation and technical reports
• Ability to work under high-pressure situations, when response time matters, to disrupt adversary activity
• Network and endpoint (macOS, Linux, Windows) investigation experience; IDS, IPS, EDR, and basic malware analysis
• Basic understanding of at least one of the following: OSQuery, SQL, and KQL
• Knowledge of frameworks such as MITRE Attack and Cyber Kill Chain
• Ability to work some weekends and holidays
• Experience with Windows and Linux command and script interpreters

Desired: 

• Cyber security certifications (GCIH, CompTIA Sec+, eJPT, etc.)  
• Experience with incident response investigations, handling malware, and performing response actions to contain and/or neutralize threats
• Experience calling customers and providing excellent customer service