Software Engineer 1

About the role

Sophos Software Engineer, Endpoint Security

Sophos is a global cybersecurity leader protecting 600,000 organizations with an AI-driven platform and expert-led services. The company supports organizations at every stage of security maturity, helping them grow their defenses to defeat evolving cyber threats. Sophos combines machine learning, automation, and real-time threat intelligence with insights from its Sophos X-Ops team to provide 24/7 threat monitoring, detection, and response.

The company's product portfolio includes industry-leading managed detection and response (MDR) and a comprehensive set of cybersecurity solutions. These solutions cover endpoint, network, email, and cloud security, as well as extended detection and response (XDR), identity threat detection and response (ITDR), and next-generation SIEM. Integrated with advisory services, these technologies enable organizations to proactively reduce risk, respond more quickly, and maintain the visibility and scalability required to stay ahead of emerging threats.

Sophos operates through a global partner ecosystem, including Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), resellers, distributors, marketplace integrations, and cyber risk partners. This approach gives organizations the flexibility to choose the partnerships that best fit their security strategies. Sophos is headquartered in Oxford, United Kingdom, and further information is available on its official website.

Sophos is seeking a Software Engineer to join its Endpoint Security Group. The successful candidate will contribute to the development of endpoint security products used by customers worldwide. You will work within an Agile team, using multiple programming languages to design features and drive secure installations across diverse regions. The role involves translating analyst workflows into robust code, collaborating with partner teams, and ensuring that services function reliably in varied environments.

Position Details

-

Location: United Kingdom

-

Engagement: Permanent

-

Compensation: 55,000 GBP per year

Key Responsibilities

You will design intake rules that define new detection logic for endpoint sensors, ensuring that security policies are enforced accurately. Your work will involve building services that stream events through processing pipelines while adhering to strict data constraints and performance requirements. You will review pull requests and changes to confirm that implemented patterns align with security expectations and organizational policies.

The role requires you to ship updates using controlled rollout strategies to ensure stability for managed accounts. You will coordinate with partner engineering teams to maintain compatibility across supported technology stacks. Additional duties include implementing telemetry markers that capture feature usage for analysis while protecting the privacy of raw event data. You will also adapt workflows to operate correctly on constrained hosts with different configurations and maintain deployment artifacts so they precisely reflect current environment requirements.

Required Qualifications

• A minimum of three years of professional programming experience using typed programming languages.
• Fluency in at least one modern programming language and proficiency with its associated toolchains, including debugging and testing practices.
• A solid understanding of network models, protocols, and standard endpoint communication paths used in security products.
• A strong commitment to data handling rules and the protection of information during transit and storage.

Preferred Qualifications

• Hands-on experience with managed security operations centers and established incident response playbooks.
• Familiarity with the workflows and tools used in security analytics and threat hunting.

Technical Skills and Tools

Your daily work will involve technologies such as Git, Python, and Linux, along with languages and frameworks including Golang, JavaScript, and TypeScript. You will also work with React, Redux, PostgreSQL, ClickHouse, Kafka, OpenSearch, Grafana, and Prometheus. On the endpoint side, your tools will include Sysmon, Elastic, and OSQuery.

Important Notes

Details discussed during the hiring process must be verified on the official application page. Specific requirements and responsibilities may vary based on business needs and technological changes. This document outlines the general expectations for the role and does not constitute an exhaustive list of all duties.