- As a Senior Threat Analyst – Tier I on our Managed Detection and Response (MDR) team, you will provide best-in-class monitoring, detection, and response services to proactively defend customer environments before attacks prevail
- You will work alongside and contribute to a team of cyber threat hunters, incident response analysts, engineers, and ethical hackers by using enterprise, log analysis and endpoint collection systems to facilitate investigations, identification, and neutralization of cyber threats
- Monitor, investigate, and respond to alerts generated by the Sophos security stack (including EDR/XDR capabilities)
- Lead and mentor Tier I Analysts through escalated cases, ensuring thorough and accurate investigation practices
- Perform end-to-end analysis on suspicious activity to assess scope, impact, and risk
- Identify and respond to cyber threats across customer environments using approved playbooks and tooling
- Accurately document findings, investigative steps, and outcomes in the MDR case management platform
- Conduct threat hunting to identify potential threats throughout the MDR customer base
- Investigate phishing emails, suspicious binaries, and behavioral anomalies
- Support detection tuning by identifying recurring false positives and suggesting improvements
- Stay informed on threat actor behaviors, MITRE ATT&CK; techniques, and Sophos threat research updates
- Proactively research emerging IOCs, active exploits, and vulnerabilities to stay ahead of evolving threats
- Contribute to internal knowledge bases, documentation, and continuous improvement initiatives
- Participate in shift rotations and ensure timely,



detailed handovers between global teams
- Provide detection and response support for active security incidents
- Manage case workflows: create cases, track progress, and follow up with clients until resolution
- Engage with clients via chat, phone, and tickets as part of case handling
- Assist with developing and refining Security Operations processes, playbooks, and tooling feedback

Benefits

- We encourage teams to get together in person periodically to help facilitate teamwork
- Remote-first working model & hybrid options
- Flexible start and end times for many roles
- Leadership development program
- Access to LinkedIn Learning
- Global internal coaching program (Coach Match)
- Periodic Sophos wellness days off for all Sophos to help employees relax and recharge
- Global wellbeing program, which offers a range of wellbeing resources, including Sophos Wellbeing Webinars, Stress Management Toolkits, and Developing Resilience Courses
- Free Employee Assistance Program (EAP) for confidential advice and counseling on a wide range of work and personal issues
- Free annual subscription to the Calm app
- Paid parental leave, caregiver leave & bereavement/compassion leave available




- We host some unforgettable social experiences for our global teams including our music festival SOPH-Fest, go-karting, Sophmudder, and incredible holiday parties
- Our annual global fitness challenge, SOPH-Fit, sees thousands of employees taking part in our virtual global race around the world
- Each quarter, we celebrate our exceptional global team by running the Sophos Values Awards, which recognizes and rewards employees who embody the Sophos values and who we are as a company
- Health care benefits available worldwide

- Bachelor’s degree in information technology, Computer Science, Cybersecurity or related field, or equivalent practical experience
- Ability to interpret and analyze Windows event logs and other telemetry data
- Must thrive within a team workplace as well as on an individual basis
- Customer-first mindset with professionalism and a focus on service excellence
- Experience handling active threats, including containment, mitigation, and recovery efforts during security incidents
- Familiar with techniques such as persistence, privilege escalation, lateral movement, and defense evasion, and able to identify these in real-world environments
- Familiarity with common incident response workflows and security operations processes
- Understanding of core network concepts including TCP/IP, protocols, routing, and traffic analysis
- Working knowledge of Windows operating systems (both workstation and server), with additional experience in Linux (Ubuntu, Debian, RedHat) or macOS environments
- A passion for cybersecurity, continuous improvement, and staying current on threat tre

📌 Senior Threat Analyst (Ottawa)
🏢 Sophos
📍 Ottawa