Security Engineer (Threat Response), Sophos Security Team (IDR)

CanadaRemoteFull-timemid

EngineeringSecurity Engineer

2 views0 saves0 applied

Apply Now

Quick Summary

Overview

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer (Threat Response),

Technical Tools

EngineeringSecurity Engineer

This is a senior security engineering role combining hands-on incident response with detection engineering, automation, and threat research. You will investigate complex cyber threats across endpoints, identity, cloud, networks, and security products while helping strengthen internal detection and response capabilities. The role goes beyond traditional incident response, with a strong focus on building scalable automations, reusable workflows, and agentic security tooling. You will use modern AI-assisted development tools while applying rigorous safety, observability, and validation practices. Collaboration spans security, engineering, product, and business teams in a globally coordinated environment. The position is remote-first and offers the opportunity to shape how advanced security operations evolve through engineering and responsible AI adoption.

You will combine incident response expertise with practical security engineering to investigate threats, improve detection capabilities, automate repetitive work, and build reliable, observable workflows that help security teams respond more effectively.

Lead complex investigations throughout the incident lifecycle, from triage and evidence collection through containment, recovery, and lessons learned.
Act as a trusted point of contact for security issues, coordinating response across incident detection and response, engineering, product, and business teams.
Conduct DFIR and endpoint forensics, including log, network, and packet analysis, malware analysis, and firewall investigations where applicable.
Develop and improve detections, playbooks, orchestrations, and prevention mechanisms using evidence from incidents and threat-hunting activities.
Build production-quality automation that reduces repetitive work, improves consistency, and enables analysts to focus on higher-value activities.
Design reusable, model-agnostic skills and workflows that can operate across approved AI and agent platforms.
Use AI-assisted development and investigation tools to accelerate coding, testing, documentation, investigations, and detection engineering.
Contribute to GitHub-based engineering workflows, including branching, pull requests, code reviews, testing, feedback cycles, and controlled deployments.
Instrument agentic workflows with logs, traces, metrics, evaluation results, and failure signals to ensure behavior and outcomes remain observable.
Apply secure harness design, least-privilege principles, scoped tool access, approval gates, evidence validation, rollback mechanisms, and human review for consequential actions.
Communicate incidents, risks, technical decisions, and outcomes clearly to engineering teams and leadership.
Continuously improve security processes and engineering practices based on incident findings, threat intelligence, operational data, and lessons learned.

Requirements

~2 min read

You bring strong enterprise incident response and security engineering experience, combined with practical development capabilities and an understanding of how automation and AI can be applied safely to security operations.

Strong enterprise incident response experience across endpoint, identity, cloud, network, and product-focused investigations.
Practical experience with DFIR, endpoint and firewall forensics, threat hunting, detection engineering, and analysis of unstructured telemetry.
Ability to develop reliable automation using Python or a comparable programming language.
Experience working with APIs and querying data using SQL.
Working knowledge of Git and GitHub engineering practices, including pull requests, code reviews, testing, and CI/CD concepts.
Hands-on familiarity with Claude, Codex, Copilot, or comparable coding-agent technologies.
Understanding of context design, task decomposition, and validation of AI-generated output.
Ability to design and write evaluations for agentic workflows and reusable skills, covering task success, output quality, safety, regressions, and common failure modes.
Understanding of agent architecture, tool usage, skill-based design, model portability, and AI or automation safety controls.
Ability to design observability for automated workflows and use telemetry to troubleshoot, measure quality, and improve reliability.
Strong written and verbal communication skills.
Sound operational security judgment and attention to safe handling of security-sensitive activities.
Ability to work effectively within a globally coordinated and distributed environment.
Legal authorization to work in Canada without requiring employer sponsorship.