{"id":1963241,"url":"https://alion.io/job/sophos-threat-analyst-3-2","title":"Threat Analyst 3","company":{"id":1926,"name":"Sophos","domain":"sophos.com","url":"https://alion.io/company/sophos","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":76,"open_postings":8,"ghost_share":0,"stale_share":0.75,"repost_share":0,"time_to_fill_p50_days":82,"computed_at":"2026-10-19T05:45:15Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Canada"],"countries":["CA"],"hiring_countries":["CA"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":52000,"max_usd":100000,"period":"year","method":"role_seniority_country_cell","sample_n":19},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Debian","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Red Hat","optional":false},{"name":"Sophos","optional":false},{"name":"TCP/IP","optional":false},{"name":"Ubuntu","optional":false},{"name":"Windows","optional":false},{"name":"osquery","optional":true},{"name":"PowerShell","optional":true},{"name":"SIEM","optional":true},{"name":"SQL","optional":true}],"status":"live","first_seen_at":"2026-10-06T16:15:00Z","employer_posted_date":"2026-10-06","last_verified_at":"2026-10-19T09:47:36Z","board_verified":true,"closed_at":null,"days_open":12,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":12},"description":"Role Summary\nAs a Threat Analyst 3 on our Managed Detection and Response (MDR) team, you will provide best-in-class monitoring, detection, and response services to proactively defend customer environments before attacks prevail. You will work alongside and contribute to a team of cyber threat hunters, incident response analysts, engineers, and ethical hackers by using enterprise, log analysis and endpoint collection systems to facilitate investigations, identification, and neutralization of cyber threats.\nWhat You Will Do\nMonitor, investigate, and respond to alerts generated by the Sophos security stack (including EDR/XDR capabilities)\nMentor junior analysts through escalated cases, ensuring thorough and accurate investigation practices.\nPerform end-to-end analysis on suspicious activity to assess scope, impact, and risk\nIdentify and respond to cyber threats across customer environments using approved playbooks and tooling\nAccurately document findings, investigative steps, and outcomes in the MDR case management platform\nConduct threat hunting to identify potential threats throughout the MDR customer base\nInvestigate phishing emails, suspicious binaries, and behavioral anomalies\nSupport detection tuning by identifying recurring false positives and suggesting improvements\nStay informed on threat actor behaviors, MITRE ATT&CK techniques, and Sophos threat research updates\nProactively research emerging IOCs, active exploits, and vulnerabilities to stay ahead of evolving threats\nContribute to internal knowledge bases, documentation, and continuous improvement initiatives\nParticipate in shift rotations and ensure timely, detailed handovers between global teams\nProvide detection and response support for active security incidents\nContribute case workflows: create cases, track progress, and follow up with clients until resolution\nEngage with clients via chat, phone, and tickets as part of case handling\nAssist with developing and refining Security Operations processes, playbooks, and tooling feedback\nWhat You Will Bring\nEssential \n3+ years of hands-on experience in a Security Operations Center (SOC), Managed Detection and Response (MDR) environment, or cybersecurity-focused IT role\nProficient in the use of endpoint and network security tools (e.g., EDR, IDS/IPS, malware detection platforms) with the ability to validate and triage complex alerts\nWorking knowledge of Windows operating systems (both workstation and server), with additional experience in Linux (Ubuntu, Debian, RedHat) or macOS environments\nAbility to interpret and analyze Windows event logs and other telemetry data\nUnderstanding of core network concepts including TCP/IP, protocols, routing, and traffic analysis\nDemonstrated experience contributing to real-time incident response efforts and threat investigations\nExposure to threat hunting methodologies and an understanding of attacker behavior and patterns\nExperience handling active threats, including containment, mitigation, and recovery efforts during security incidents\nFamiliar with techniques such as persistence, privilege escalation, lateral movement, and defense evasion, and able to identify these in real-world environments\nFamiliarity with common incident response workflows and security operations processes\nStrong analytical thinking and troubleshooting skills, with attention to detail in investigations and case documentation\nExcellent communication skills, with the ability to clearly explain findings to both technical and non-technical audiences\nCustomer-first mindset with professionalism and a focus on service excellence\nMust thrive within a team environment as well as on an individual basis\nNatural curiosity and willingness to learn in a fast-paced, ever-changing threat landscape\nA passion for cybersecurity, continuous improvement, and staying current on threat trends\nBachelor's degree in information technology, Computer Science, Cybersecurity or related field, or equivalent practical experience\nWillingness to participate in shift work including nights, weekends and holidays (our MDR service is 24x7x365)\nDesirable\nFamiliarity with the MITRE ATT&CK framework and its application in detection and response\nExperience working with SIEM platforms and managing enterprise security telemetry\nAbility to write and interpret SQL queries for data analysis and investigation\nExperience with OSQuery and scripting skills, particularly in PowerShell\nRelevant and practical cybersecurity certifications (e.g., GSEC, GCIA, GCIH, PEN-200, Security Blue Team L1, TCM Academy SOC L1, or similar)","description_format":"text","description_chars":4567,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Network Security","Endpoint Security","Security Operations","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-06T16:26:37Z"}],"visa":[{"country":"CA","licensed_sponsor":true,"evidence":"Positions approved through LMIA in 12 months: 1","filings_12m":1,"filings_prev_12m":1,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Global Talent Stream","cap_exempt":false,"checked_at":"2026-10-03T21:10:52+00:00","sources":["ESDC: employers issued a positive LMIA"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":12,"expected_fill_days":82,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-19T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/sophos-threat-analyst-3-2","json_url":"https://alion.io/job/sophos-threat-analyst-3-2.json","meta":{"generated_at":"2026-10-19T13:07:20Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9335,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1926},"rest":"https://alion.io/mcp/rest/get_company?id=1926"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsophos-threat-analyst-3-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsophos-threat-analyst-3-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsophos-threat-analyst-3-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sophos-threat-analyst-3-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsophos-threat-analyst-3-2"}]}