Incident Response Analyst

Role Summary

What you will do

• Utilize Sophos technologies to investigate, contain, and respond to cyber incidents
• Conduct analysis of cyber incidents for malware, ransomware, and other common attack types
• Maintain accurate and detailed documentation for analysis performed during cyber incidents
• Recognize and codify attacker tools, tactics, and procedures that can be applied to current and future investigations and tooling
• Provide clear and concise communication to MDR customers during cyber incidents
• Work closely with internal SophosLabs, Detection Engineering, and Threat Hunting teams to continuously expand and improve detection logic
• Work closely with Sophos MDR Operations teams in providing response, remediation guidance, and excellent customer service
• Assist in creating accurate and detailed technical incident reports as a post-incident deliverable for MDR customers and MSPs

What you will bring

• Essential skills:
• 3-6 years of experience conducting cyber security investigations in a methodical manner and investigating threats
• Knowledge of incident response toolsets, methodologies, and techniques
• Experience creating technical documentation and technical reports
• Ability to work under high-pressure situations, when response time matters, to disrupt adversary activity
• Network and endpoint (macOS, Linux, Windows) investigation experience; IDS, IPS, EDR, and basic malware analysis
• Basic understanding of at least one of the following: OSQuery, SQL, and KQL
• Knowledge of frameworks such as MITRE Attack and Cyber Kill Chain
• Ability to work some weekends and holidays
• Experience with Windows and Linux command and script interpreters
 
• Desired skills:
Cyber security certifications (GCIH, CompTIA Sec+, eJPT, etc.) 
Experience with incident response investigations, handling malware, and performing response actions to contain and/or neutralize threats
Experience calling customers and providing excellent customer service