MDR Team Lead

Role Overview

• Lead day-to-day MDR operations, overseeing case queues, analyst workloads, SLA performance, escalations, and resource allocation to ensure consistent service delivery.
• Guide and review incident investigations, validating findings, assessing business impact, recommending response actions, and ensuring appropriate escalation management.
• Serve as a key point of coordination during customer and internal escalations, providing clear updates, risk assessments, recommendations, and resolution plans.
• Coach, mentor, and develop MDR analysts through case reviews, feedback, skills development, and performance management.
• Conduct quality reviews of investigations, customer communications, documentation, and calls to drive operational excellence and continuous improvement.
• Analyse operational metrics and dashboards to identify trends, risks, capacity constraints, and opportunities to improve service quality, efficiency, and customer outcomes.
• Develop and maintain SOPs, playbooks, workflows, and knowledge-base content to improve consistency and operational readiness.
• Provide technical leadership in intrusion analysis, incident response, digital forensics, malware investigations, and threat hunting activities.
• Lead response efforts during significant security incidents, ensuring effective coordination, decision-making, and ownership through resolution.
• Stay current on threat actor tactics, techniques, and procedures (TTPs), leveraging threat intelligence to enhance investigations, detections, and response capabilities.
• Partner with Engineering, Labs, and Content teams to improve detection quality, reduce false positives, and address recurring investigation gaps.

Requirements

• Up to 12 years of total work experience.
• 5+ years of experience in cybersecurity, with a minimum of 2-3 years of experience leading, mentoring, or coordinating analysts in a SOC, MDR, Incident Response, or similar environment.
• Bachelor’s degree in Information Technology, Computer Science, or a related field, or equivalent practical experience.
• Hands-on experience in security operations, including threat detection, incident investigation, and response.
• Strong understanding of endpoint and network security technologies, including IDS/IPS, EDR, ATP, malware protection, and monitoring platforms.
• Experience with threat hunting methodologies and familiarity with the MITRE ATT&CK framework preferred.
• Working knowledge of incident response processes, adversary tactics and techniques, and cyber threat intelligence.
• Strong technical expertise in Windows environments, including host artefacts, endpoint telemetry, event log analysis, and operating system security events; exposure to macOS and Linux is a plus.
• Solid understanding of network fundamentals, including TCP/IP, routing, switching, and traffic analysis.
• Experience with SIEM platforms and enterprise security data management; database querying skills are advantageous.
• Working knowledge of PowerShell and Python for automation and investigation support.
• Strong analytical, troubleshooting, and decision-making skills, with the ability to prioritise effectively in high-pressure situations.
• Excellent written and verbal communication skills, including the ability to produce clear reports, case summaries, operational updates, and executive-ready communications.
• Experience performing quality reviews and providing actionable feedback that improves investigation outcomes and analyst performance.
• Proven ability to build team capability through coaching, onboarding, training, and knowledge sharing.
• Strong stakeholder management and customer-facing skills, with the capability to explain technical findings, risks, and recommendations to both technical and non-technical audiences.
• Advanced cybersecurity certifications are preferred but not required.

Tech Stack

• Cyber Security
• Linux
• MacOS
• Python
• Switching
• TCP/IP

Benefits

• Sophos operates a remote-first working model
• Employee-led diversity and inclusion networks that build community and provide education and advocacy
• Annual charity and fundraising initiatives and volunteer days for employees to support local communities
• Global employee sustainability initiatives to reduce our environmental footprint
• Global fitness and trivia competitions to keep our bodies and minds sharp
• Global wellbeing days for employees to relax and recharge
• Monthly wellbeing webinars and training to support employee health and wellbeing