Threat Analyst 1

Overview

Threat Analyst 1 on Sophos's Managed Threat Response (MDR) team, providing 24x7x365 monitoring, detection and response to defend customer environments against cyber threats.

What you'll do

• Investigate and analyze logs and security-related events via Sophos tooling
• Identify and respond to cyber threats occurring within customer environments
• Communicate and document findings to customer audiences including technical and executive teams
• Follow up with customers through to issue resolution and provide detailed recommendations to minimize risk in customer environments
• Acknowledge and satisfy inbound customer requests and interact with customers through various mediums
• Collaborate and assist with core security and threat response teams
• Actively research emerging Indicators of Compromise/Attack, exploits and vulnerabilities and operationalize findings to better protect customers

What you'll need

• Willingness to work outside standard business hours, including weekends and holidays
• Excellent troubleshooting and analytical skills, with proven ability to think outside the box
• Customer service-oriented with strong written and verbal communication skills
• Must thrive within a team environment as well as on an individual basis
• Passion for all things related to information technology and cybersecurity
• Natural curiosity and ability to learn new skills quickly
• Innovative mindset and driven to contribute to a team providing a best-in-class cybersecurity service
• Minimum 2+ years of experience working in a SOC environment or computer security team in an IT environment
• Experience with threat hunting
• Experience with endpoint and network security monitoring
• Experience administering and supporting Windows OS (both workstations and server) and one of the following: Apple or Linux-based operating systems (e.g. XP, Windows 7, 2003, 2008, OS X)
• Knowledge of common adversary tactics and techniques, e.g., obfuscation, persistence, defense evasion, etc.
• Knowledge of Mitre ATT&CK framework
• Knowledge of incident response procedures
• Basic understanding of network traffic analysis including TCP/IP, routing, switching, protocols, etc.
• Basic understanding of Windows event log analysis

Nice to have

• Experience with SQL query construction
• Experience with OSQuery
• Experience with enterprise information security data management
• SIEM experience
• Programming and scripting skills
• Proficient knowledge of PowerShell

Details

• Location: Canada
• Remote-first working model; applicants must have legal authorization to work in the jurisdiction where the position is posted, without requiring employer sponsorship
• Base salary range in Canada: $56,000 to $93,000, plus bonus eligibility and a comprehensive benefits package