Security Engineer

• Independently detect, investigate and respond to cyber threats across Sophos and its products, while engineering the detections, automations, reusable skills and agentic workflows that scale Internal Detection and Response
• The role combines incident response judgement with security engineering and the safe, measurable and observable use of AI
• Own complex investigations across the incident lifecycle, from triage and evidence collection through containment, recovery and lessons learned
• Act as a trusted front door for security issues, coordinating response across IDR, engineering, product and business teams
• Perform DFIR and endpoint forensics, including log, network and packet analysis, malware analysis and firewall investigation where applicable
• Write and improve detections, playbooks, orchestrations and preventions using evidence from incidents and threat hunting
• Build production-quality automation that removes repetitive work, improves consistency and enables analysts to operate at a higher layer
• Design model-agnostic, reusable skills and workflows that run across approved AI and agent platforms rather than depending on one model
• Use Claude, Codex, Copilot and future approved tooling to accelerate investigations, coding, testing, documentation and detection engineering
• Contribute through GitHub: create branches, raise and review pull requests, write tests, respond to feedback and support controlled deployment
• Instrument agentic workflows with logs, traces, metrics, evaluation results and failure signals so behaviour and outcomes are observable
• Apply safe harness design, least privilege, scoped tool access, approval gates, evidence validation, rollback and human review for consequential actions
• Communicate incidents, risks, decisions and technical outcomes clearly to engineering and leadership audiences

Benefits

• We encourage teams to get together in person periodically to help facilitate teamwork
• Remote-first working model & hybrid options
• Flexible start and end times for many roles
• Leadership development program
• Access to LinkedIn Learning
• Global internal coaching program (Coach Match)
• Periodic Sophos wellness days off for all Sophos to help employees relax and recharge
• Global wellbeing program, which offers a range of wellbeing resources, including Sophos Wellbeing Webinars, Stress Management Toolkits, and Developing Resilience Courses
• Free Employee Assistance Program (EAP) for confidential advice and counseling on a wide range of work and personal issues
• Free annual subscription to the Calm app
• Paid parental leave, caregiver leave & bereavement/compassion leave available
• We host some unforgettable social experiences for our global teams including our music festival SOPH-Fest, go-karting, Sophmudder, and incredible holiday parties
• Our annual global fitness challenge, SOPH-Fit, sees thousands of employees taking part in our virtual global race around the world
• Each quarter, we celebrate our exceptional global team by running the Sophos Values Awards, which recognizes and rewards employees who embody the Sophos values and who we are as a company
• Health care benefits available worldwide

• Understanding of agent architecture, tool use, skill-based design, model portability and AI or automation safety controls
• Hands-on familiarity with Claude, Codex or comparable coding agents, including context design, task decomposition and validation of generated output
• Ability to design and write evals for agentic workflows and skills, covering task success, output quality, safety, regressions and common failure modes
• Clear written and verbal communication, sound opsec judgement and the ability to work effectively in a globally coordinated environment
• Practical capability in DFIR, endpoint and firewall forensics, threat hunting, detection engineering and analysis of unstructured telemetry
• Ability to write reliable automation in Python or a comparable language, work with APIs and query data using SQL
• Working knowledge of Git and GitHub engineering practices, including pull requests, code review, testing and CI/CD concepts
• Ability to design observability for automated work and use telemetry to troubleshoot, measure quality and improve reliability
• Strong enterprise incident response experience across endpoint, identity, cloud, network and product-focused investigations
• At Sophos, we believe in the power of diverse perspectives to fuel innovation.

Research shows that candidates sometimes hesitate to apply if they don’t check every box in a job description.

We challenge that notion.

Your unique experiences and skills might be exactly wh