Senior Incident Response Analyst

About this job

As a Senior Incident Response Analyst at Sophos in India, you will lead the investigative execution of active cyber incidents within the Critical Incident Response Team, supporting Managed Detection and Response customers and managed service providers. The team defends organizations globally using an AI-driven platform and frontline human expertise. A normal day in this fast-paced role involves investigating, containing, and remediating cyber threats, making quick context-based decisions to disrupt adversary activity, conducting customer calls to discuss incidents, mentoring junior analysts, and maintaining detailed documentation of your findings.

Responsibilities

• Utilize Sophos technologies to investigate, contain, and respond to active cyber incidents.
• Mentor incident response and MDR operations analysts by offering technical guidance and escalation support.
• Perform advanced analysis to identify initial access, persistence, and lateral movement for threat remediation.
• Support customers and MSPs via calls and meetings to provide priority recommendations.
• Conduct thorough analysis of cyber incidents involving malware, ransomware, and other attacks.
• Maintain accurate and detailed documentation for analysis performed during incidents.
• Collaborate with internal SophosLabs, Detection Engineering, and Threat Hunting teams to expand detection logic.

Requirements

• 4+ years experience conducting cyber security investigations or 2+ years experience performing incident response engagements.
• Understanding of network architecture and IT infrastructure.
• Experience creating technical documentation and customer reports.
• Ability to work under high-pressure situations to disrupt adversary activity.
• Network and endpoint investigation experience including macOS, Linux, Windows, IDS, IPS, EDR, and basic malware analysis.
• Understanding of at least one of OSQuery, SQL, and KQL.
• Experience applying frameworks like MITRE Attack and Cyber Kill Chain.
• Knowledge of Windows and Linux command and script interpreters.

Good to have

• Advanced cyber security certifications such as GCFE/GCFA, CompTIA CySA+, or OSCP.
• Experience calling customers and providing customer service.
• Publications within the cyber security field.

Who should apply

This role suits experienced cybersecurity professionals with a strong background in conducting incident response engagements and threat investigations. Candidates should be comfortable working under pressure in fast-paced environments, possess solid endpoint and network analysis skills, and be able to communicate effectively with customers. The posting does not state that freshers can apply, as it specifically requires several years of prior experience in cybersecurity investigations or incident response.

Frequently asked questions