Senior Threat Researcher –Detection Engineer

Posted 9 Days Ago
Be an Early Applicant
Hiring Remotely in Canada
Remote
3-5 Years Experience
Security • Software
The Role
Join our global team as a Senior Threat Researcher and Detection Engineer. In this role, you will hunt for threats, conduct research, and develop real-time detection capabilities for suspicious activity. You will be responsible for writing classification rules, mapping IOCs to MITRE Att&ck matrix, and analyzing kill chains to discover new TTPs. Strong knowledge of Windows OS, programming experience in Python and Lua, and expertise in MITRE Att&ck tactics are required. This is a senior-level position with a focus on problem-solving and big data analysis.
Summary Generated by Built In

About Us

Sophos is a global leader and innovator of advanced security solutions that defeat cyberattacks, including Managed Detection and Response (MDR) and incident response services and a broad portfolio of endpoint, network, email, and cloud security technologies. As one of the largest pure-play cybersecurity providers, Sophos defends more than 600,000 organizations and more than 100 million users worldwide from active adversaries, ransomware, phishing, malware, and more. Sophos’ services and products connect through the Sophos Central management console and are powered by Sophos X-Ops, the company’s cross-domain threat intelligence unit. Sophos X-Ops intelligence optimizes the entire Sophos Adaptive Cybersecurity Ecosystem, which includes a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity and information technology vendors. Sophos provides cybersecurity-as-a-service to organizations needing fully managed security solutions. Customers can also manage their cybersecurity directly with Sophos’ security operations platform or use a hybrid approach by supplementing their in-house teams with Sophos’ services, including threat hunting and remediation. Sophos sells through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.


Role Summary

Threat hunter? Programmer? Data-driven? We have a fantastic opportunity here at Sophos Labs for a Threat Researcher to join our global team of behavior-based detection engineers, to hunt, to research, and to add real-time detection for suspicious activity across our customer environments. Our team of skilled security experts combine their passion to detect & disrupt cyber-attacks with their capability to develop classification rules that can cut through the noise in modern computing environments to tease out attacker’s nefarious activities. You are intrinsically motivated to understand the core logic behind malware and hacking attacks, to find & predict new ways attackers will modify their techniques and take great satisfaction in developing robust detection logic that is immune to evasive actions. You will be responsible for writing rules that are able to detect malicious activities across all types of TTP (even if a Mitre Technique doesn’t exist yet). This is the foundation of Sophos next-gen approach. Above all - you enjoy thinking creatively; combining your deep technical knowledge, your tenacity for innovation, and your can-do attitude to solve complex and challenging problems on a daily basis.


What You Will Do

  • Understand malware kill chain and lifecycle & hands-on-keyboard attacks
  • Accurate & efficient classification of malicious & suspicious behavior
  • Mapping TTPs to MITRE ATT&CK matrix 
  • Author classification rules, for both Endpoint & Cloud scenarios, to identify malicious & suspicious use of TTPs
  • Analyze real-world kill chains to discover new TTPs and gaps in coverage
  • Measure and tune TTP coverage through data mining, customer telemetry & internal sandbox feeds
  • Build & maintain playbooks on threat actor TTPs

What You Will Bring

  • Strong knowledge of Windows operating system, internals & forensic tools
  • Demonstrated programming experience. Preferred: Python, Lua, RegEx and/or SQL.
  • Excellent grasp of MITRE ATT&CK tactics, techniques & procedures in order to create simulation
  • Familiar with computational cost analysis & problem solving to minimize impact
  • Bachelor’s degree in computer software (Computer Security preferable) or equivalent experience
  • Big data experience, Elastic Search, Kibana, Redshift
  • SDLC or CI/CD Knowledge is a plus

In Canada, the base salary for this role ranges from $107,000 to $179,000. In addition to base salary, we offer additional compensation including bonus eligibility and a comprehensive benefits package. A candidate’s specific pay within this range will depend on a variety of factors, including job-related skills, training, location, experience, relevant education, certifications, and other business and organizational needs. 


#B2

#LI-SS1

#LI-Remote


Ready to Join Us?

At Sophos, we believe in the power of diverse perspectives to fuel innovation. Research shows that candidates sometimes hesitate to apply if they don't check every box in a job description. We challenge that notion. Your unique experiences and skills might be exactly what we need to enhance our team. Don't let a checklist hold you back – we encourage you to apply.


What's Great About Sophos?

· Sophos operates a remote-first working model, making remote work the primary option for most employees. However, some roles may necessitate a hybrid approach. Please refer to the location details in our job postings for further information.

· Our people – we innovate and create, all of which are accompanied by a great sense of fun and team spirit

· Employee-led diversity and inclusion networks that build community and provide education and advocacy

· Annual charity and fundraising initiatives and volunteer days for employees to support local communities

· Global employee sustainability initiatives to reduce our environmental footprint

· Global fitness and trivia competitions to keep our bodies and minds sharp

· Global wellbeing days for employees to relax and recharge 

· Monthly wellbeing webinars and training to support employee health and wellbeing


Our Commitment To You

We’re proud of the diverse and inclusive environment we have at Sophos, and we’re committed to ensuring equality of opportunity. We believe that diversity, combined with excellence, builds a better Sophos, so we encourage applicants who can contribute to the diversity of our team. All applicants will be treated in a fair and equal manner and in accordance with the law regardless of gender, sex, gender reassignment, marital status, race, religion or belief, color, age, military veteran status, disability, pregnancy, maternity or sexual orientation. We want to give you every opportunity to show us your best self, so if there are any adjustments we could make to the recruitment and selection process to support you, please let us know. 


Data Protection

If you choose to explore an opportunity, and subsequently share your CV or other personal details with Sophos, these details will be held by Sophos for 12 months in accordance with our Privacy Policy and used by our recruitment team to contact you regarding this or other relevant opportunities at Sophos. If you would like Sophos to delete or update your details at any time, please follow the steps set out in the Privacy Policy describing your individual rights. If you have any questions about Sophos’ data protection practices, please contact [email protected].

Top Skills

Lua
Python
The Company
Burlington, MA
3,747 Employees
On-site Workplace
Year Founded: 1985

What We Do

Cybersecurity Evolved.

As a worldwide leader in next-generation cybersecurity, Sophos protects nearly 400,000 organizations of all sizes in more than 150 countries from today’s most advanced cyberthreats.

Powered by SophosLabs – a global threat intelligence and data science team – Sophos’ cloud-native and AI-enhanced solutions secure endpoints (laptops, servers and mobile devices) and networks against evolving cybercriminal tactics and techniques, including automated and active-adversary breaches, ransomware, malware, exploits, data exfiltration, phishing, and more.

Jobs at Similar Companies

CrowdStrike Logo CrowdStrike

Regional Sales Manager, Major Accounts (Remote, DEU)

Cloud • Information Technology • Sales • Security • Cybersecurity
Remote
Germany
10000 Employees

CrowdStrike Logo CrowdStrike

Technical Support Engineer - Weekend Coverage (Remote, MEX)

Cloud • Information Technology • Sales • Security • Cybersecurity
Remote
México
10000 Employees

CrowdStrike Logo CrowdStrike

Specialist Sales Manager, NG SIEM

Cloud • Information Technology • Sales • Security • Cybersecurity
Mumbai, Maharashtra, IND
10000 Employees

CrowdStrike Logo CrowdStrike

Specialist Sales Manager, NG SIEM

Cloud • Information Technology • Sales • Security • Cybersecurity
Delhi, Connaught Place, New Delhi, Delhi, IND
10000 Employees

Similar Companies Hiring

Getty Images Thumbnail
Software • News + Entertainment • Natural Language Processing • Machine Learning • Generative AI • Digital Media • Computer Vision
Seattle, WA
1700 Employees
Rokt Thumbnail
Software • Marketing Tech • eCommerce • Digital Media • Artificial Intelligence
New York, NY
500 Employees
Citadel Thumbnail
Software • Information Technology • Financial Services • Big Data Analytics
Miami, FL
4000 Employees

Sign up now Access later

Create Free Account

Please log in or sign up to report this job.

Create Free Account