Sophos Certified Engineer

ET15, ET80 · ● Active · Professional · Sophos

Multi-track professional certification validating expertise in Sophos Central Endpoint (ET15) and Sophos Firewall XGS (ET80) product families. Widely recognized in MSP/channel partner ecosystems and SMB security operations.

Exam facts

Vendor source — Sophos Academy ↗
Official exam guide — Sophos Support Certification Program (SCP) ↗
Exam objectives — Sophos Learning Portal ↗

About

The Sophos Certified Engineer certification suite validates hands-on expertise in configuring, deploying, and managing Sophos endpoint protection and firewall solutions. Offered through Sophos Academy with free or low-cost partner training, this cert has become the de facto standard in SMB and MSP security operations — particularly for teams managing small-to-medium fleets of endpoints or multi-branch firewalls. The certification is not vendor-neutral (unlike CompTIA Security+ or CEH) but carries significant weight in Sophos partner ecosystems, job postings, and career progression toward Sophos-focused security engineering or MSP leadership roles. Active since the Sophos XG generation and regularly updated for current product versions (e.g., Central Endpoint v3.x, Firewall v20+).

Domain context — Security

Professional-level security certification spanning endpoint detection/response, firewall rule architecture, threat response, and synchronized security coordination. Primary use case: SMB/MSP security operations, Sophos product-stack deployment, and security engineering at organizations running Sophos suites.

Read full deep dive — Security →

Topics covered

ET15 (Sophos Central Endpoint)

• Deployment modes (cloud vs. on-premise)
• Endpoint protection features (Intercept X, EDR/XDR)
• Policy and group management
• Threat detection and incident response
• Integration with Central admin console
• Live response and forensics capabilities

ET80 (Sophos Firewall / XGS)

• Firewall deployment modes and licensing
• Zone and rule configuration
• NAT, port forwarding, and VPN setup
• IPSec and SSL/TLS VPN protocols
• Intrusion prevention (IPS) policies
• Web filtering and content control
• High availability (HA) failover fundamentals
• Central management and orchestration
• Advanced routing (BGP/OSPF for Architect track)

Source: Sophos Academy Training Courses ↗

Common skills at Security · Professional

Shared content for the Security domain at Professional level — not specific to this cert.

• Threat intelligence and threat actor profiling (APT campaigns, malware families, CVE tracking)
• Incident response coordination and containment (NIST, SANS IR methodology)
• Log aggregation and SIEM query construction (Splunk, ELK, Azure Sentinel basics)
• Firewall rule design and network segmentation (DMZ, VLANs, east-west micro-segmentation)
• Vulnerability assessment and patch management (Qualys, Nessus interpretation, patch testing)
• Security architecture trade-offs (defense-in-depth, zero-trust principles, compliance overhead)

Recommended courses at Security · Professional

Practice exams

Books

Note: Sophos certifications rely heavily on vendor documentation rather than traditional published books. Official Sophos training materials and product guides are the primary study sources.

Typical job titles at Security · Professional

Sophos Engineer · MSP Security Engineer (Sophos focus) · Sophos Systems Administrator · Managed Security Services Engineer · SMB IT Security Specialist

(Job titles drawn from current job-board postings and MSP/channel partner career paths.)

Salary

Salary rule: Salary ranges reflect Security Engineer roles in SMB/MSP contexts, as Sophos-specific role titles are less common than product-agnostic titles. Sophos cert significantly improves candidate competitiveness in MSP hiring pipelines. For current MSP security engineer positions, check ZipRecruiter, LinkedIn, or regional job boards filtering for "Sophos" + "engineer."

Skills validated

Cert-specific — what this exam actually tests, distinct from shared "Common skills" above.

• Sophos Central endpoint deployment and policy configuration (Intercept X layers)
• Threat detection workflow (behavioral analysis, sandboxing, live response)
• EDR/MDR operational practices (event investigation, remediation, forensic data interpretation)
• Sophos Firewall rule logic (zones, policies, logging, implicit-deny architecture)
• VPN setup and troubleshooting (IPSec, SSL/TLS, split tunneling, dial-up scenarios)
• IPS policy tuning (signature management, false-positive reduction, evasion techniques)
• High-availability firewall failover (synchronized state, license management, failback)
• Sophos Central management console (deployment, reporting, dashboards, API basics)
• Incident response using Sophos tools (alert investigation, containment via Central, evidence collection)

Related certifications

• Stacks with: Sophos Certified Architect (AT15 / AT80) ↗ — next tier for advanced design & HA
• Prerequisite for: Sophos technical leadership roles; entry point to Sophos solutions architect
• Replaces: N/A — no predecessor cert; Sophos XG generation is current (no major sunset announced)
• Equivalents at this level: CompTIA Security+ ↗ (broader), Cisco CCNA Security (legacy) ↗ (networking-focused), Palo Alto Networks PCNSE (entry-level) ↗
• Vendor overview: Sophos ↗

Sources

• Sophos Academy ↗
• Sophos Support Certification Program (SCP) ↗
• Sophos Partner Portal ↗
• Sophos Certified Engineer Practice Exams (ExamZify) ↗
• Glassdoor Security Engineer Salaries ↗
• Levels.fyi Sophos Salaries ↗
• IT Jobs Watch ↗

Last verified: 2026-05-01
Parent ecosystem: Sophos Endpoint & Firewall
Parent domain: Security
Vendor overview: Sophos