Senior Incident Response Consultant, Rapid Response

SophosCybersecurity incident response

Location: United Kingdom; Workplace: Remote. For remote roles, you may work remotely within the location specified in the job posting.Full-TimeSenior

Salary not disclosed

Apply NowOpens the employer's application page

Job Details

Experience: 5+ years of experience leading incident response investigations involving ransomware
Required Skills: PythonSQL

Have 5+ years of experience leading incident response investigations involving ransomware.
Have experience leading business email compromise (BEC) investigations.
Demonstrate a track record of neutralizing and remediating ransomware threats.
Have a strong understanding of incident response processes, cyber risks, and mitigation strategies.
Be able to qualify cyber risks for customers and communicate technical information clearly to executive-level stakeholders.
Have a strong grasp of the MITRE ATT&CK framework.
Have experience with SIEM technology such as Splunk or ELK.
Have experience writing SQL queries.
Have experience writing PowerShell, Python, or Bash scripts.
Have post-secondary education in cybersecurity or comparable education.
Be willing to work some weekends and holidays and occasional overtime during peak periods.
Be willing to occasionally start early or stay late for customer engagements.
Be able to manage time, prioritize and delegate across multiple incidents, and work under stressful circumstances.
Be willing to mentor junior analysts and share knowledge with the team.
Cybersecurity certifications such as CISSP or GCFA are an asset.

Lead customer kickoff calls to understand the incident and identify initial threat-containment actions.
Guide customers on post-incident best practices and remediation.
Lead daily customer update calls to present forensic findings and provide concise email updates between calls.
Direct forensic investigations, set priorities, and delegate tasks to analysts.
Manage multiple Rapid Response incidents concurrently.
Determine analyst-identified TTPs and add them to the threat intelligence platform.
Write timely executive-summary reports with key-event timelines mapped to the MITRE ATT&CK framework.
Contribute to the development of the Sophos Rapid Response service through basic-to-moderate-complexity projects.
Provide daily handover notes to teams in different time zones or when transferring incident responsibility.

View Full Description & ApplyYou'll be redirected to the employer's site