S

Sophos

Subscription-based cybersecurity for endpoints, networks, MDR

Threat Analyst 2

Full-Time
CA$66k - CA$110k/yr+ Bonus
Mid
Remote in Canada
RemoteRemote within Canada; must have legal work authorization.
CybersecuritySecurity Operations & Incident Response

About the job

Requirements
  • Minimum 3+ years of experience working in a SOC environment or computer security team in an IT environment
  • Experience with threat hunting
  • Experience with endpoint and network security monitoring
  • Experience administering and supporting Windows OS (both workstations and server) and one of the following: Apple or Linux-based operating systems (e.g. XP, Windows 7, 2003, 2008, OS X)
  • Knowledge of common adversary tactics and techniques, e.g., obfuscation, persistence, defense evasion, etc.
  • Knowledge of Mitre ATT&CK framework
  • Knowledge of incident response procedures
  • Basic understanding of network traffic analysis including TCP/IP, routing, switching, protocols, etc.
  • Basic understanding of Windows event log analysis
Responsibilities
  • Investigate and analyze logs and security-related events via Sophos tooling
  • Identify and respond to cyber threats occurring within customer environments
  • Communicate and document findings to various customer audiences including technical and executive teams
  • Follow up with customers through to issue resolution and drive continuous improvement by providing detailed recommendations to minimize risk in customer environments
  • Acknowledge and satisfy inbound customer requests and interact with customers through various mediums
  • Collaborate and assist with core security and threat response teams
  • Actively research emerging Indicators of Compromise/Attack, exploits and vulnerabilities with the intent of operationalizing findings to better protect our customers
Desired Qualifications
  • Experience with SQL query construction
  • Experience with OSQuery
  • Experience with enterprise information security data management - SIEM experience
  • Programming and scripting skills - proficient knowledge of Powershell

About the company

Sophos provides cybersecurity solutions for businesses, covering endpoint, network, and mobile security, with a cloud-based management console called Sophos Central. Its products protect devices, networks, and mobile endpoints, and include Managed Detection and Response (MDR) where experts monitor and respond to threats. The company differentiates itself by offering an integrated, single-vendor security stack—covering endpoint, network, and mobile protection—managed from one platform. Its goal is to help organizations prevent digital threats while simplifying security operations.

Company Size

5,001-10,000

Company Stage

Debt Financing

Total Funding

$411.9M

Headquarters

Abingdon, United Kingdom

Founded

1985

Get referred to Sophos

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • Sophos Fusion's August 15, 2026 GA expands XDR, MDR, and Next-Gen SIEM.
  • OpenAI Daybreak and Anthropic collaborations add frontier-model workflows to MDR and Managed Risk.
  • Dicker Data's August 24, 2026 distribution deal expands Sophos reach across Australia and New Zealand.

What critics are saying

  • Thoma Bravo is refinancing Sophos's $2.1 billion loan due March 2027.
  • Thoma Bravo refused fresh equity, increasing leverage pressure if lenders balk in 2026.
  • Microsoft Defender and CrowdStrike Falcon pressure pricing as AI-native security commoditizes by 2027.

What makes Sophos unique

  • Sophos Fusion unifies EDR, XDR, MDR, SIEM, email, cloud, and advisory controls.
  • Sophos embeds Secureworks Taegis analytics into XDR, adding thousands of detectors and SOAR.
  • Sophos serves 625,000 organizations through a large MSP and reseller ecosystem.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Health Insurance
  • Disability Insurance
  • Remote Work Options
  • Wellness Program
  • Mental Health Support

Growth & Insights and Company News

Headcount

6 month growth

14%

1 year growth

14%

2 year growth

14%
CxOToday
Oct 16th, 2026
How Sophos streamlined Salesforce Change Management with Whatfix's In-App Guidance.

How Sophos streamlined Salesforce Change Management with Whatfix's In-App Guidance. 12,000 fewer Salesforce support tickets a year, a 15% YoY reduction in global Sales Ops cases, 1,070 hours saved by streamlining seller training and support, 116K+ in-app interactions with Salesforce Flows and Smart Tips. The Sophos Story - Leading global cybersecurity company Sophos is a leading global cybersecurity company offering software and hardware solutions. Listed on the London Stock Exchange and a constituent of the FTSE 250 Index, the company is headquartered in Abingdon, United Kingdom, with 3,319 employees across US, EMEA, and APAC regional offices. Sophos went live with Salesforce to streamline its sales process and manage client relationships more effectively. However, frequent platform updates and internal customisations made it difficult for sellers to keep pace. By implementing Whatfix's digital adoption platform, Sophos gave its sales teams interactive, on-demand training and support inside Salesforce, reducing support ticket volumes and helping users adapt to change in the flow of work. The challenge - Frequent Salesforce Updates Made Change Hard to Manage Salesforce released new features and updates every quarter, and Sophos wanted its sales teams to benefit from them across the sales process. On top of this, Sophos updated and customised Salesforce every month to suit internal requirements. With users spread across 7 countries, the change challenge was magnified further. While the Sales Operations team strongly believed in in-person training, it recognised the need for self-serve training and support that users could access at the moment of need. Sophos chose Whatfix's DAP to deliver interactive, on-demand guidance, based on four factors: * Usability for admins: an easy-to-use tool to create, publish, analyse, and manage in-app help content * Effectiveness for users: just-in-time, moment-of-need training for Salesforce users * Customer service: quick support turnaround from the Whatfix team * Time-to-value: the fastest go-live time compared to other DAP competitors The Solution - In-App Guidance for Effective Change Management and Unified Communication Sophos used Whatfix to manage change on Salesforce and to reinforce the learning delivered during initial training. * Effective change management * In-App Support: Sales representatives gained a 24/7, personalised in-app digital assistant with on-demand information from both Whatfix content and integrated knowledge bases. Users no longer needed to raise tickets and could move on with their tasks, contributing to a 15% (~12,000 tickets) global reduction in Sales Ops support tickets. * Real-Time Training: Updates, communication, and training were delivered directly within Salesforce, increasing recall of onboarding training with interactive guidance at the point of need. * Business Compliance: In-app Smart Tips provided contextual information on each new Salesforce button, form field, action, and flow. Sophos recorded 116,061 Smart Tips shown in 12 months, or roughly 400 engaged with daily, helping users become more confident and proficient. * Unified internal communication Sophos took a systematic approach to its Salesforce launch and change plan: * Its IT and HR teams first built interactive walkthroughs and product tours covering Salesforce basics, core features, and workflows such as lead and opportunity creation. * The team then moved to more complex features where users faced friction, using guided walkthroughs and intelligent pop-ups. * Sophos also embedded videos and other media in Whatfix to align its sales and product management teams, unifying product communication that previously relied on multiple tools. The Results - Whatfix Cut Support Tickets and Saved Sellers Over 1,000 Hours Using Whatfix, Sophos made Salesforce change management lighter for both users and support teams. Here are the results: * 15% YoY reduction in global Sales Ops support cases, equal to roughly 12,000 fewer tickets a year * 1,070 hours saved by streamlining seller training and support * 116,061 Smart Tips shown over 12 months, with around 400 engaged daily * 116K+ interactions with in-app Salesforce Flows and Smart Tips * Training, updates, and communication delivered in real time inside Salesforce, improving recall of onboarding training "Whatfix is a contributing factor to YoY 15% reduction in Sales Ops cases globally," said Phil Walley, Sales Operations Manager, Sophos. The Bigger Picture - Why Change Management Now Depends on Guidance Inside the Application Sophos's experience shows that the real test of a CRM investment begins after go-live. With Salesforce releasing updates every quarter and Sophos customising the platform every month, the rate of change quickly outpaced what classroom-style training could cover, particularly across users in 7 countries. Whatfix closed that gap by moving learning to where work happens. Instead of relying on sellers to recall training or raise a ticket, Sophos placed contextual guidance, from Flows to Smart Tips to a 24/7 in-app assistant, directly inside Salesforce. The outcome was measurable: ~12,000 fewer support tickets a year and 1,070 hours returned to sellers and support teams. The 116K+ in-app interactions also show that users actively chose this guidance as part of their daily workflow. For enterprises running frequently updated platforms, Sophos offers a useful model. Adoption is not a one-time training event. It is an ongoing process that has to keep pace with every release and customisation. By placing guidance inside the application, teams can support users through each change without adding to the support load.

PR Newswire
Oct 15th, 2026
GTCR co-leads $200M second lien loan for Sophos refinancing

GTCR, a private equity firm, has jointly led a $200 million second lien term loan for cybersecurity company Sophos, which is owned by Thoma Bravo. The loan was raised as Sophos refinances its existing $2.45 billion first lien term loan. Based in Oxford, UK, Sophos serves about 625,000 customers, mostly small and medium-sized businesses and mid-market organisations. In February 2025, it acquired Secureworks, adding an enterprise-focused managed detection and response business. The deal follows the close of GTCR's first Capital Solutions Fund, which makes bespoke minority structured investments. "Our ongoing dialogue with Thoma Bravo and familiarity with the sector enabled us to move quickly," said Jason Prager, managing director at GTCR.

VSDaily
Oct 12th, 2026
Sophos named Leader in 2026 IDC MarketScape for enterprise Modern Endpoint Security.

Sophos named Leader in 2026 IDC MarketScape for enterprise Modern Endpoint Security. Sophos has been recognized as a Leader in the IDC MarketScape Worldwide Modern Endpoint Security for Enterprises 2026 Vendor Assessment. The company's AI-native Sophos Endpoint solution delivers prevention-first protections to defend businesses against rapidly accelerating, AI-driven threats without adding operational overhead. MALAYSIA, 12 OCTOBER 2026 - Global cybersecurity provider Sophos has achieved Leader status in the IDC MarketScape Worldwide Modern Endpoint Security for Enterprises 2026 Vendor Assessment. The recognition comes at a critical time as artificial intelligence drastically reduces the window between vulnerability discovery and threat execution. According to the Sophos AI Security 2026 Report, major security vulnerabilities are now weaponized and exploited within 24 to 36 hours of public disclosure, creating severe patch management challenges for enterprise security operational teams. Sophos Endpoint tackles this shrinking response window through deep learning artificial intelligence capable of blocking known and novel malware variants, including synthetic AI-mutated threats, prior to execution. Built with over 60 pre-configured exploit mitigations active on every process, the platform protects system integrity automatically, avoiding operational complexity or extensive manual tuning. Kyle Falkenhagen, senior vice president of product management at Sophos, emphasized that artificial intelligence is compressing reaction times across modern attack vectors. He noted that Sophos Endpoint provides the prevention-first security required to intercept threats before they result in business-disrupting events, extending protective capabilities through the broader Sophos Fusion ecosystem. In its evaluation, the IDC MarketScape report highlighted Sophos as an ideal solution for organizations requiring an open, unified security platform with native identity threat detection, strong third-party integration, and automated defense capabilities requiring minimal configuration. Serving as a foundational control point within the Sophos Fusion architecture, Sophos Endpoint feeds telemetry into a central intelligence repository alongside insights from over 500 third-party security tools. Powered by Sophos X-Ops threat intelligence, the interconnected platform defends more than 625,000 organizations globally by correlating real-time threat data across cloud, email, firewall, and identity assets.

IT Pro
Oct 9th, 2026
Overe targets MSP and SMB security gains with former Sophos CSO appointment.

Overe targets MSP and SMB security gains with former Sophos CSO appointment. Overe wants to bolster support for MSPs and small businesses after a "massive win" on the recruitment front Former Sophos chief security officer (CSO) Simon Reed has joined Overe as a strategic advisor in a move CEO Paul Barnes believes will supercharge engagement with managed service providers (MSPs). Launched three years ago, Overe offers a cybersecurity platform designed to help MSPs and small businesses secure Microsoft 365 and SaaS tools. Speaking to ITPro, Barnes said the inspiration for launching the firm came after his experiences with a previous venture, endpoint security startup Prevx. At its height, before being acquired by Webroot, Prevx had more than 15,000 MSPs using its product. With Overe, Barnes hopes to build on that success and bolster support for what he said has traditionally been a market overlooked by larger vendors. Latest Videos FromChannelPro 0 seconds of 1 minute, 21 seconds Volume 0% Press shift question mark to access a list of keyboard shortcuts Keyboard Shortcuts Shortcuts Open/Close / or? Play/Pause SPACE Increase Volume Decrease Volume Seek Forward Seek Backward Captions On/Off c Fullscreen/Exit Fullscreen f Mute/Unmute m Decrease Caption Size - Increase Caption Size + or = Seek % 0-9 3 ways to bring down your digital transformation costs "We're very much focused on the MSP market because that's been something which I'm extremely passionate about," he told ITPro. "We know how underserved that market is and those clients which the MSPs serve." According to Barnes, the state of the security vendor market in 2026 requires a rethink. Large organizations such as Microsoft, for example, typically focus on larger clients, leaving a vacuum where smaller businesses are "kind of left to manage themselves". Combined with traditional challenges such as costs and skill capabilities, this places organizations at great risk amidst an increasingly perilous threat landscape, he added.

GlobeNewswire
Oct 5th, 2026
Sophos named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises.

Sophos named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises. Recognition notes Sophos' key strengths including strong up-front protection across web, exploit, and ransomware vectors, validated across multiple independent testing programs, which reduces analyst workload and alert volume. October 05, 2026 09:00 ET | Source: Sophos Inc. OXFORD, U.K., Oct. 05, 2026 (GLOBE NEWSWIRE) - Sophos, a global cybersecurity leader, today announced that it has been named a Leader in the IDC MarketScape: Worldwide Modern Endpoint Security for Enterprises 2026 Vendor Assessment (#US54123526, September 2026). As AI accelerates vulnerability discovery, exploit development, and attack execution, security teams face a shrinking window to respond. The Sophos AI Security 2026 Report found recent high-profile vulnerabilities exploited within 24 to 36 hours of disclosure, underscoring just how little time remains to patch and correlate signals manually across the environment. Sophos Endpoint is designed to close that gap. Its deep learning AI is designed to identify known and previously unseen malware, including AI-generated and AI-mutated variants, before execution, while more than 60 exploit mitigations, enabled by default on every process, help block the techniques attackers rely on to weaponize vulnerabilities. Because these prevention-first protections are enabled by default, enterprises gain stronger protection without added operational complexity. "AI is compressing the time between vulnerability discovery and exploitation, and security teams are still grappling with the realities of patching at scale," said Kyle Falkenhagen, senior vice president of product management at Sophos. "We believe this recognition reflects Sophos' ability to meet the needs of enterprises operating in increasingly complex, fast-moving threat environments. Organizations need endpoint protection that stops the techniques attackers rely on before they become business-impacting events, and that's exactly what Sophos Endpoint is built to deliver. As part of Sophos Fusion, that protection extends into a coordinated defense system that acts across the entire environment." According to the IDC MarketScape: "Consider Sophos when organizations need a unified, open platform with strong third-party integration, native identity threat detection, and automation. SMBs to large enterprises are seeking out-of-the-box, protection-first endpoint security with minimal tuning." We believe this recognition adds to Sophos' longstanding leadership in endpoint security across market segments, underscoring Sophos' ability to deliver enterprise-grade protection for organizations ranging from growing businesses to the world's largest enterprises. Sophos Endpoint is a foundational control point within Sophos Fusion, the Sophos AI-native cybersecurity defense system. Endpoint telemetry contributes to a unified context lake alongside signals from other Sophos controls and more than 500 third-party integrations. Through Synchronized Security, a threat detected at the endpoint can trigger coordinated action elsewhere in the environment, while signals from identity, firewall, email, cloud and other control points can strengthen endpoint investigation and response. Backed by Sophos X-Ops threat intelligence and real-world incident response insights, Sophos Fusion compounds intelligence across the more than 625,000 organizations Sophos defends. This shared intelligence helps security teams manage their Sophos products, review detections from Sophos and third-party security controls, investigate suspicious activity, and remediate threats from a connected platform. IDC MarketScape vendor analysis model is designed to provide an overview of the competitive fitness of technology and service suppliers in a given market. The research methodology utilizes a rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each vendor's position within a given market. The Capabilities score measures vendor product, go-to-market and business execution in the short-term. The Strategy score measures alignment of vendor strategies with customer requirements in a 3-5-year timeframe. Vendor market share is represented by the size of the circles. Vendor year-over-year growth rate relative to the given market is indicated by a plus, neutral or minus next to the vendor name. About Sophos Sophos, a global cybersecurity leader, defends more than 625,000 organizations worldwide with Sophos Fusion, the industry's first and most complete AI-native cybersecurity defense system: a single, connected architecture where every control point operates as one. Powered by agentic AI and elite human expertise, Sophos detects, investigates, and neutralizes threats before they become business-disrupting events. Working alongside a global ecosystem of managed service providers, resellers, and technology partners, Sophos compounds intelligence from every threat encountered and every environment defended to make every customer's defense stronger than the last. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com. Media Contact Kelly Archer Sr. Director, Global PR [email protected]