Senior Advisor, Incident Response

Role Overview

• Manage intake, processing, and disposition of physical devices and digital media for incident response, ensuring proper physical space management, chain of custody, forensic imaging, and digital media lifecycle management.
• Support the physical and virtual infrastructure used for customer engagement, responding to consultants' and customers' requests related to engagement data and technology.
• Collaborate with cross-functional teams to implement solutions that meet functional requirements, including troubleshooting and problem resolution.
• Utilize advanced and specialized knowledge of legacy products, services, technologies, and infrastructure to enhance usability, availability, and security.
• Leverage expertise in security-related protocols, products, and internally developed technologies to develop innovative security solutions.
• Participate in and provide security solutions across all stages of the digital media lifecycle, including forensic imaging efforts and data pre-processing initiatives.
• Assist with Change Management procedures by engaging in pre-deployment Quality Assurance testing of planned technology modifications to ensure reliability and serviceability.
• Document processes and procedures related to digital media lifecycle management, forensic imaging, and data pre-processing to improve operational efficiency.
• Serve as the primary Emergency Incident Response (EIR) Intake consultant, handling inbound calls, verifying customer service levels, creating account records, and leading initial scoping calls.
• Coordinate the commercial paperwork required to initiate work efforts, including Engagement Work Orders (EWO) and Statements of Work (SOW).
• Manage initial evidence intake for EIR engagements, provisioning forensic tooling such as Endpoint Detection & Response (EDR) agents and other third-party forensic analysis solutions.
• Provision cloud analysis Virtual Machines (VMs) for consultants, serving as a subject matter expert on VM provisioning and troubleshooting.
• Manage and maintain lab physical equipment to support forensic investigations and incident response efforts.

Requirements

• At least 5 years of professional experience with managed threat response and remediation.
• 5 years of experience with threat actor tactics, techniques, and procedures (TTPs), identifying and analyzing vulnerabilities and using tools to exploit them.
• 5 years of experience in digital forensics, network forensics, and security practices.
• 5 years of experience managing incident response engagements, including documentation and case handling in CRM systems.
• 5 years of experience with encryption methods and Multi-Factor Authentication (MFA).
• 5 years of experience developing end-user documentation.
• 5 years of experience with firewall management and information security protocols.
• 5 years of experience in Microsoft Windows, Linux, and Unix system administration.
• 5 years of experience with network security infrastructure, including load balancers, reverse proxies, and web proxies.
• 5 years of experience provisioning cloud infrastructure using AWS and Azure, and troubleshooting cloud infrastructure issues.
• 5 years of experience provisioning forensic tooling for Endpoint Detection & Response (EDR) solutions.
• 5 years of experience leading Emergency Incident Response scoping calls.

Tech Stack

• AWS
• Azure
• Cloud
• Linux
• Unix

Benefits

• Sophos operates a remote-first working model, making remote work the primary option for most employees. However, some roles may necessitate a hybrid approach.
• Our people – we innovate and create, all of which are accompanied by a great sense of fun and team spirit
• Employee-led diversity and inclusion networks that build community and provide education and advocacy
• Annual charity and fundraising initiatives and volunteer days for employees to support local communities
• Global employee sustainability initiatives to reduce our environmental footprint
• Global fitness and trivia competitions to keep our bodies and minds sharp
• Global wellbeing days for employees to relax and recharge
• Monthly wellbeing webinars and training to support employee health and wellbeing