Software Development Engineer (Test) 3 (UK)

About this role

About Us Sophos is a cybersecurity leader defending 600,000 organizations globally with an AI-driven platform and expert-led services. Sophos meets organizations wherever they are in their security maturity and grows with them to defeat cyberattacks. Its solutions combine machine learning, automation, and real-time threat intelligence with frontline human expertise from Sophos X-Ops to deliver advanced, 24/7 threat monitoring, detection, and response.

Sophos offers industry-leading managed detection and response (MDR) alongside a comprehensive portfolio of cybersecurity technologies — including endpoint, network, email, and cloud security, extended detection and response (XDR), identity threat detection and response (ITDR), and next-gen SIEM. Together with expert advisory services, these capabilities help organizations proactively reduce risk and respond faster, with the visibility and scalability needed to stay ahead of evolving threats.

Sophos goes to market with a global partner ecosystem, including Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), resellers and distributors, marketplace integrations, and cyber risk partners, giving organizations the flexibility to choose trusted relationships when securing their business. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com. About the Linux Behavioural Engine team The Linux Behavioural Engine team builds the runtime detection capability that protects Linux servers, workloads and containers.

Our engine watches process, file, network and kernel-level activity as it happens, correlates it into meaningful behaviour, and decides in real time whether something is benign or an attack in progress. That means we live close to the kernel, across a wide spread of distributions, kernel versions and deployment shapes bare metal, VMs, containers and managed Kubernetes. Getting this right at scale is as much a testing and infrastructure problem as it is a detection problem: a change that behaves perfectly on Ubuntu 24.04 may behave very differently on a hardened RHEL kernel or inside a locked-down EKS node.

We are a small, autonomous team that owns its own CI, its own test estate and its own quality bar. It is a good place to broaden quickly. You will get exposure to CI, cloud infrastructure, Kubernetes and low-level Linux security in one role, with senior engineers close at hand to learn from.