Security Engineer (Threat Response), Sophos Security Team (IDR)

Responsibilities

• Own complex investigations across the incident lifecycle, from triage and evidence collection through containment, recovery and lessons learned.
• Act as a trusted front door for security issues, coordinating response across IDR, engineering, product and business teams.
• Perform DFIR and endpoint forensics, including log, network and packet analysis, malware analysis and firewall investigation where applicable.
• Write and improve detections, playbooks, orchestrations and preventions using evidence from incidents and threat hunting.
• Build production-quality automation that removes repetitive work, improves consistency and enables analysts to operate at a higher layer.
• Design model-agnostic, reusable skills and workflows that run across approved AI and agent platforms rather than depending on one model.
• Use Claude, Codex, Copilot and future approved tooling to accelerate investigations, coding, testing, documentation and detection engineering.
• Contribute through GitHub: create branches, raise and review pull requests, write tests, respond to feedback and support controlled deployment.
• Instrument agentic workflows with logs, traces, metrics, evaluation results and failure signals so behaviour and outcomes are observable.
• Apply safe harness design, least privilege, scoped tool access, approval gates, evidence validation, rollback and human review for consequential actions.

Languages