Security Engineer (Threat Response), Sophos Security Team (IDR)

Accountabilities:

You will combine incident response expertise with practical security engineering to investigate threats, improve detection capabilities, automate repetitive work, and build reliable, observable workflows that help security teams respond more effectively.

• Lead complex investigations throughout the incident lifecycle, from triage and evidence collection through containment, recovery, and lessons learned.
• Act as a trusted point of contact for security issues, coordinating response across incident detection and response, engineering, product, and business teams.
• Conduct DFIR and endpoint forensics, including log, network, and packet analysis, malware analysis, and firewall investigations where applicable.
• Develop and improve detections, playbooks, orchestrations, and prevention mechanisms using evidence from incidents and threat-hunting activities.
• Build production-quality automation that reduces repetitive work, improves consistency, and enables analysts to focus on higher-value activities.
• Design reusable, model-agnostic skills and workflows that can operate across approved AI and agent platforms.
• Use AI-assisted development and investigation tools to accelerate coding, testing, documentation, investigations, and detection engineering.
• Contribute to GitHub-based engineering workflows, including branching, pull requests, code reviews, testing, feedback cycles, and controlled deployments.
• Instrument agentic workflows with logs, traces, metrics, evaluation results, and failure signals to ensure behavior and outcomes remain observable.
• Apply secure harness design, least-privilege principles, scoped tool access, approval gates, evidence validation, rollback mechanisms, and human review for consequential actions.
• Communicate incidents, risks, technical decisions, and outcomes clearly to engineering teams and leadership.
• Continuously improve security processes and engineering practices based on incident findings, threat intelligence, operational data, and lessons learned.

Requirements

You bring strong enterprise incident response and security engineering experience, combined with practical development capabilities and an understanding of how automation and AI can be applied safely to security operations.

• Strong enterprise incident response experience across endpoint, identity, cloud, network, and product-focused investigations.
• Practical experience with DFIR, endpoint and firewall forensics, threat hunting, detection engineering, and analysis of unstructured telemetry.
• Ability to develop reliable automation using Python or a comparable programming language.
• Experience working with APIs and querying data using SQL.
• Working knowledge of Git and GitHub engineering practices, including pull requests, code reviews, testing, and CI/CD concepts.
• Hands-on familiarity with Claude, Codex, Copilot, or comparable coding-agent technologies.
• Understanding of context design, task decomposition, and validation of AI-generated output.
• Ability to design and write evaluations for agentic workflows and reusable skills, covering task success, output quality, safety, regressions, and common failure modes.
• Understanding of agent architecture, tool usage, skill-based design, model portability, and AI or automation safety controls.
• Ability to design observability for automated workflows and use telemetry to troubleshoot, measure quality, and improve reliability.
• Strong written and verbal communication skills.
• Sound operational security judgment and attention to safe handling of security-sensitive activities.
• Ability to work effectively within a globally coordinated and distributed environment.
• Legal authorization to work in Canada without requiring employer sponsorship.

Benefits

• Base salary ranging from $86,000 to $143,000 CAD.
• Additional compensation, including bonus eligibility.
• Comprehensive employee benefits package.
• Remote-first working model, with remote work serving as the primary option for most employees.
• Employee-led diversity and inclusion networks focused on community, education, and advocacy.
• Annual charity, fundraising, and employee volunteer initiatives.
• Global sustainability initiatives supporting efforts to reduce environmental impact.
• Global fitness and trivia activities supporting employee connection and wellbeing.
• Global wellbeing days designed to provide time to relax and recharge.
• Monthly wellbeing webinars and training focused on employee health and wellbeing.
• Inclusive environment that values diverse perspectives, collaboration, innovation, and continuous learning.
• Opportunity to work at the intersection of incident response, threat intelligence, detection engineering, automation, and responsible AI adoption.
• Recruitment and selection accommodations available to support candidates who require adjustments.