About the role

Senior Threat Analyst monitoring, investigating, and responding to cyber threats for Sophos’s MDR cybersecurity services. Conducting threat hunting, incident response, and client case management.

Responsibilities

Monitor, investigate, and respond to alerts generated by the Sophos security stack, including EDR/XDR capabilities
Lead and mentor Tier I Analysts through escalated cases
Perform end-to-end analysis of suspicious activity to assess scope, impact, and risk
Identify and respond to cyber threats across customer environments using approved playbooks and tooling
Document findings, investigative steps, and outcomes in the MDR case management platform
Conduct threat hunting across the MDR customer base
Investigate phishing emails, suspicious binaries, and behavioral anomalies
Support detection tuning by identifying recurring false positives and suggesting improvements
Stay informed on threat actor behaviors, MITRE ATT&CK techniques, and Sophos threat research
Research emerging IOCs, active exploits, and vulnerabilities
Contribute to internal knowledge bases, documentation, and continuous improvement initiatives
Participate in shift rotations and provide detailed handovers between global teams
Provide detection and response support for active security incidents
Manage case workflows and follow up with clients until resolution
Engage with clients via chat, phone, and tickets
Assist with developing and refining Security Operations processes, playbooks, and tooling

5+ years of hands-on experience in a Security Operations Center (SOC), Managed Detection and Response (MDR) environment, or cybersecurity-focused IT role
Proficient in endpoint and network security tools, including EDR, IDS/IPS, and malware detection platforms
Working knowledge of Windows workstation and server operating systems, plus Linux or macOS
Ability to interpret and analyze Windows event logs and other telemetry data
Understanding of TCP/IP, protocols, routing, and traffic analysis
Experience contributing to real-time incident response efforts and threat investigations
Exposure to threat hunting methodologies and attacker behavior patterns
Experience handling active threats, including containment, mitigation, and recovery
Familiarity with persistence, privilege escalation, lateral movement, and defense evasion techniques
Familiarity with incident response workflows and security operations processes
Strong analytical thinking and troubleshooting skills
Excellent communication skills for technical and non-technical audiences
Customer-first mindset and professionalism
Ability to work both within a team and independently
Bachelor's degree in information technology, Computer Science, Cybersecurity or related field, or equivalent practical experience
Willingness to participate in shift work including nights, weekends and holidays
Legal authorization to work in Canada without employer sponsorship