[Hiring] Incident Response Engineer @Sophos

Role Description

Incident Response Consultants play a key role in supporting customers through cybersecurity incidents by coordinating the response between the customer, DFIR consultants, and other technical teams. This is a customer-facing role focused on incident coordination, communication, and ensuring that response activities progress effectively from initial engagement through to resolution.

• Act as a primary coordination point between customers and DFIR consultants during active cybersecurity incidents.
• Coordinate and host incident scoping calls with customers to understand the incident, establish requirements, and support the engagement of the appropriate DFIR resources.
• Coordinate incident response activities from initial engagement through investigation, remediation, and closure.
• Work with DFIR consultants to understand investigation progress, priorities, dependencies, and customer requirements.
• Maintain clear communication with customers throughout an incident, including investigation status, next steps, outstanding actions, and information requirements.
• Coordinate meetings, incident updates, deliverables, and follow-up activities between customers and internal technical teams.
• Help customers gather and provide the information, logs, system access, and technical context required by DFIR consultants.
• Track actions, decisions, dependencies, and outstanding items throughout the incident lifecycle.
• Identify potential delays, communication gaps, or blockers and work with the appropriate stakeholders to resolve or escalate them.
• Translate technical investigation updates into clear, customer-appropriate language without changing the technical findings or conclusions of the investigation.
• Translate incident reports, investigation updates, and other customer communications from English into Japanese when required, ensuring technical meaning and context are accurately maintained.
• Support the preparation and delivery of customer updates, investigation reports, and incident debriefing sessions.
• Coordinate with other cybersecurity teams, including Threat Intelligence, Technical Testing, Managed Detection and Response, and other relevant specialists when required.
• Help ensure customers receive a consistent, professional, and well-coordinated experience during what can be a highly stressful situation.

Qualifications

• 3+ years of experience working in cybersecurity, information technology, security operations, incident management, technical support, or a related technical environment.
• Experience supporting, coordinating, or working with cybersecurity incidents will be highly valued.
• Strong understanding of cybersecurity fundamentals and common security technologies.
• Good understanding of enterprise IT environments, including Windows, networking, identity, cloud services, and security technologies.
• Ability to understand and discuss cybersecurity incidents with technical specialists without needing to personally conduct digital forensic investigations.
• Strong customer-facing communication skills and experience working with customers during technical or security incidents.
• Experience coordinating technical activities involving multiple teams and stakeholders.
• Strong organisational skills and the ability to manage multiple activities, priorities, and dependencies during time-sensitive situations.
• Ability to communicate complex technical information clearly to stakeholders with different levels of technical knowledge.
• Confidence working with customers during high-pressure or business-critical situations.
• Native-level Japanese language proficiency, with professional proficiency in English.

Desirable

• Experience working in a Security Operations Centre, Managed Security Service, Incident Response, cybersecurity consulting, technical account management, or similar environment.
• Previous experience coordinating cybersecurity incidents, major IT incidents, or other technical response activities.

Benefits

• Sophos operates a remote-first working model, making remote work the primary option for most employees. However, some roles may necessitate a hybrid approach.
• Our people – we innovate and create, all of which are accompanied by a great sense of fun and team spirit.
• Employee-led diversity and inclusion networks that build community and provide education and advocacy.
• Annual charity and fundraising initiatives and volunteer days for employees to support local communities.
• Global employee sustainability initiatives to reduce our environmental footprint.
• Global fitness and trivia competitions to keep our bodies and minds sharp.
• Global wellbeing days for employees to relax and recharge.
• Monthly wellbeing webinars and training to support employee health and wellbeing.