Senior Threat Analyst

What You Will Do

• Monitor, investigate, and respond to alerts generated by the Sophos security stack (including EDR/XDR capabilities)
• Act as the escalation point for Tier I and Tier II Analysts, leading complex and high-severity investigations through to resolution
• Lead the technical response to major security incidents, coordinating containment and remediation activities with customers and internal teams
• Mentor and coach Tier I and Tier II Analysts, and quality-review case work to ensure thorough and accurate investigation practices
• Perform end-to-end analysis on suspicious activity to assess scope, impact, and risk
• Identify and respond to cyber threats across customer environments using approved playbooks and tooling
• Accurately document findings, investigative steps, and outcomes in the MDR case management platform
• Plan and lead hypothesis-driven threat hunts across the MDR customer base, informed by threat intelligence and adversary behavior
• Investigate phishing emails, suspicious binaries, and behavioral anomalies
• Drive detection improvements by identifying recurring false positives and coverage gaps, and by authoring or refining detection logic
• Stay informed on threat actor behaviors, MITRE ATT&CK techniques, and Sophos threat research updates
• Proactively research emerging IOCs, active exploits, and vulnerabilities to stay ahead of evolving threats
• Author and maintain playbooks, knowledge base articles, and documentation, and contribute to continuous improvement initiatives
• Participate in shift rotations and ensure timely, detailed handovers between global teams
• Manage case workflows: create cases, track progress, and follow up with clients until resolution
• Engage with clients in English and Japanese via chat, phone, and tickets, clearly explaining findings and recommended actions
• Contribute to the development of Security Operations processes and provide feedback on tooling

What You Will Bring

• 5+ years of hands-on experience in a Security Operations Center (SOC), Managed Detection and Response (MDR) environment, or cybersecurity-focused IT role
• Proven experience leading incident response efforts, including containment, mitigation, and recovery during active security incidents
• Strong experience with endpoint and network security tools (e.g., EDR, XDR, IDS/IPS, malware defense platforms), with the ability to validate and triage complex alerts
• Hands-on threat hunting experience, with a solid understanding of attacker behavior and patterns
• In-depth knowledge of adversary tactics and techniques such as obfuscation, persistence, privilege escalation, lateral movement, and defense evasion, and the ability to identify these in real-world environments
• Strong working knowledge of Windows operating systems (both workstation and server), with additional experience in Linux (Ubuntu, Debian, RedHat) or macOS environments
• Strong ability to analyze Windows event logs and other telemetry data
• Solid understanding of network traffic analysis, including TCP/IP, routing, switching, and protocols
• Experience mentoring, coaching, or reviewing the work of other analysts
• Excellent troubleshooting and analytical thinking skills, with attention to detail in investigations and case documentation
• Excellent written and verbal communication skills, with the ability to clearly explain findings to both technical and non-technical audiences
• Customer-first mindset with professionalism and a focus on service excellence
• Must thrive within a team environment as well as on an individual basis
• Natural curiosity and ability to learn new skills quickly in a fast-paced, ever-changing threat landscape
• A proactive approach to improving detections, processes, and tooling
• A passion for cybersecurity, continuous improvement, and staying current on threat trends
• Bachelor's degree in Information Technology, Computer Science, Cybersecurity or related field, or equivalent practical experience
• Business-level Japanese (JLPT N2 or above, or native) and business-level English, both written and spoken
• Willingness to participate in shift work including nights, weekends and holidays (our MDR service is 24x7x365)

Desirable

• Strong knowledge of the MITRE ATT&CK framework and its application in detection and response
• Experience working with SIEM platforms and managing enterprise security telemetry
• Ability to write and interpret SQL queries for data analysis and investigation
• Experience with OSQuery
• Programming and scripting skills, particularly in PowerShell
• Advanced cybersecurity certifications (e.g., GCIH, GCFA, GCIA, GREM, OSCP, CISSP, or similar)