Senior Incident Response Consultant, Rapid Response

Sophos

. Lead incident response engagements for customers affected by cybersecurity attacks .

Posted 10/14/2026full-timeRemote • CanadaSenior💰 CA$109,000 - CA$181,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading incident response investigations, particularly in ransomware and BEC cases, while effectively communicating with customers and mentoring junior analysts. Proficient in utilizing the MITRE ATT&CK framework for threat analysis and ensuring timely remediation of cyber threats.

Highest-signal resume keywords

Incident Response LeadershipRansomware InvestigationMITRE ATT&CK FrameworkForensic Investigation ManagementCyber Risk Assessment

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident Response ProcessForensic AnalysisRoot Cause AnalysisThreat Intelligence ManagementProject Management

Soft Skills

Oral CommunicationWritten CommunicationTime ManagementDelegationTeam Collaboration

Certifications & Qualifications

Post-Secondary Education in Cybersecurity

Industry Keywords

CybersecurityBEC InvestigationsThreat LandscapeData ExfiltrationRapid Response

Tech Stack

Tools & technologies

Cyber Security

About the role

Key responsibilities & impact

Lead incident response engagements for customers affected by cybersecurity attacks
Lead kickoff calls to understand customer situations and identify initial containment actions
Guide customers on post-incident best practices
Lead daily customer update calls and deliver forensic findings
Provide concise email updates between calls
Direct forensic investigations, identify priorities, and delegate tasks to analysts
Conduct multiple Rapid Response incidents concurrently
Determine analyst-identified TTPs and add them to the threat intelligence platform
Ensure teams and customers take appropriate actions to neutralize threats
Conduct root cause analysis, including determining whether data exfiltration occurred
Write executive-summary reports with event timelines mapped to the MITRE ATT&CK framework
Manage basic to moderate complexity projects supporting development of the Sophos Rapid Response service
Provide daily handover notes to teams in different time zones or transferring incident responsibility
Mentor and assist junior analysts

Requirements

What you’ll need

5+ years of experience leading incident response investigations involving ransomware
Experience leading BEC investigations
Continuously learning and staying informed of the changing threat landscape
Proven track record of successful neutralization and remediation of ransomware threats
Excellent understanding of the Incident Response process
Excellent understanding of cyber risks and ability to qualify them to customers
Excellent oral communication skills
Strong written communication skills
Ability to manage time effectively
Ability to delegate and prioritize tasks across multiple incidents
Ability to excel under stressful circumstances
Willingness to begin work early and/or stay late when warranted for customer engagements
Strong grasp of the MITRE ATT&CK framework
Enjoy mentoring and assisting in the development of junior analysts
Team-player attitude and willingness to share knowledge
Ability to work some weekends and holidays
Post-secondary education in Cybersecurity, comparable
Legal authorization to work in Canada without employer sponsorship

Benefits

Comp & perks

Bonus eligibility
Comprehensive benefits package
Remote-first working model
Employee-led diversity and inclusion networks
Annual charity and fundraising initiatives
Volunteer days
Global employee sustainability initiatives
Global fitness and trivia competitions
Global wellbeing days
Monthly wellbeing webinars and training
Equality of opportunity and recruitment adjustments