Threat Analyst 2

About this job

As a Threat Analyst 2 at Sophos, you will join an organization that is a cybersecurity leader, defending hundreds of thousands of organizations globally using an AI-driven platform and expert-led services. Sophos combines machine learning, automation, and real-time threat intelligence with human expertise from Sophos X-Ops to offer advanced, 24/7 managed detection and response (MDR). In this role, you will work with enterprise systems, log analysis tools, and endpoint collection systems to investigate, identify, and neutralize cyber threats. A normal day involves exploring escalated security alerts, performing structured analyses to determine attack scopes and root causes, examining potential ransomware activity or suspicious scripts, conducting threat hunts, and collaborating with senior analysts. You will operate within a rotational schedule supporting a 24x7x365 MDR environment, helping clients proactively reduce risk and respond faster to evolving cyber threats.

Responsibilities

• Investigate escalated security alerts and incidents across endpoint, network, cloud, and identity environments.
• Perform structured analysis to determine root cause, attack scope, and potential impact.
• Support ransomware investigations by analyzing attacker activity, persistence mechanisms, and malware behavior.
• Conduct proactive threat hunts based on defined hypotheses and emerging threat intelligence.
• Investigate suspicious authentication activity, privilege escalation, and identity misuse.
• Correlate data across multiple sources like EDR, SIEM, cloud logs, and identity platforms.
• Document investigative findings clearly and provide actionable remediation guidance to clients.
• Contribute to detection tuning and participate in a rotational schedule supporting a 24x7x365 MDR environment.

Requirements

• 3 to 5 years of experience in a SOC, MDR, Incident Response, or related cybersecurity operations role.
• Experience investigating endpoint and network security alerts using EDR and SIEM platforms.
• Working knowledge of ransomware attack patterns and common intrusion techniques.
• Hands-on experience investigating Linux and Windows systems.
• Familiarity with adversary tactics and techniques, and practical exposure to the MITRE ATT&CK framework.
• Scripting knowledge, including PowerShell; Python or other languages is mandatory.
• Strong documentation skills and attention to investigative detail.

Good to have

• Security certifications such as Security+, CySA+, GCIH, or equivalent.
• Basic understanding of cloud and identity security investigations.

Who should apply

This role suits professionals with 3 to 5 years of experience in cybersecurity operations, incident response, or SOC environments who want to grow their investigative expertise. Candidates must have hands-on experience with Windows and Linux systems, EDR and SIEM tools, and mandatory scripting skills in PowerShell, Python, or similar languages. Freshers are not eligible to apply as the position explicitly requires several years of relevant industry experience.

Frequently asked questions