Security Automation Researcher, Sophos

• 6+ years in security operations, automation, incident response, or related fields, with progressive responsibilities and demonstrated impact at organizational or industry scale
• Experience leading security automation strategy at an enterprise level
• 2+ years of experience mapping, analyzing, or documenting technical workflows in a SOC, security engineering, or IT operations environment to support process automation or tooling development
• Strong analytical skills with the ability to translate complex workflows into clearly defined processes
• Experience in researching and documenting security operations, incident response, or similar technical processes
• Strong troubleshooting, debugging, and analytical skills, with proven ability to think outside the box
• Ability to convert documented requirements into actionable coding tasks in both independent and collaborative environments
• Solid understanding of cybersecurity operations principles and best practices
• Customer service-oriented with strong written and verbal communication skills
• Must thrive within a team environment as well as on an individual basis
• Natural curiosity and ability to learn new skills quickly
• Innovative mindset and driven to contribute to a team providing a best-in-class cybersecurity service
• Familiarity with Security Orchestration, Automation, and Response (SOAR) concepts or platforms is preferred
• Detail-oriented, with a proven passion for continuous improvement in cybersecurity practices
• Advanced certifications in cybersecurity, project management, or automation (e.g., CISSP, SANS, PMP, AWS Certified Security)
• Hands-on implementation of AI/ML-powered security solutions in production

Desirable

• The Security Automation Researcher identifies and defines valuable automation opportunities for Sophos Managed Services
• By researching workflows, analyzing operational data, and collaborating with key stakeholders, this role produces clear requirements to be implemented by Security Automation Engineering
• The Security Automation Researcher also determines which units of work require analyst review, monitors how often those units of work accurately identify actionable activity, and measures efficiency gains from automated processes
• Investigate diverse workflows, tools, and processes across internal and external sources
• Identify gaps and bottlenecks in existing operations that can benefit from automation
• Determine which units of work should be escalated to services teams by evaluating risk indicators, severity, and historical data
• Track and analyze how frequently escalated units of work identify actionable activity to refine automated detection and prioritization logic
• Document potential automation triggers, use cases, and workflows in a concise, requirements-driven format for the Engineering team
• Work closely with stakeholders to refine requirements and align them with organizational service delivery objectives
• Track efficiency gains, return on investment (ROI), and effectiveness of newly introduced automated workflows
• Provide regular reports on active units of work and detection rates, presenting data-driven recommendations to senior management and cross-functional teams
• Collaborate with subject-matter experts (e.g., SOC analysts, incident responders) to capture detailed process steps and best practices
• Stay updated on industry trends and emerging technologies to proactively identify new automation opportunities
• Host knowledge-sharing sessions and workshops to communicate new automation concepts and outcomes