Remote opportunity at
NebiusDetection & Response Engineer
Nebius wants a Detection and Response Engineer to help establish and operate its detection and response function across Nebius Cloud. The post is remote and full-time.…
Career Tools
About This Role
Nebius wants a Detection and Response Engineer to help establish and operate its detection and response function across Nebius Cloud. The post is remote and full-time. Nebius is a Nasdaq-listed company based in Amsterdam that delivers an AI cloud spanning GPU scheduling, inference tuning, storage and networking for developers and enterprises. The engineer contributes to detection work, threat intelligence and incident handling. Responsibilities include creating detections with minimal false alarms…
Job Description
Nebius wants a Detection and Response Engineer to help establish and operate its detection and response function across Nebius Cloud. The post is remote and full-time. Nebius is a Nasdaq-listed company based in Amsterdam that delivers an AI cloud spanning GPU scheduling, inference tuning, storage and networking for developers and enterprises.
The engineer contributes to detection work, threat intelligence and incident handling. Responsibilities include creating detections with minimal false alarms and misses, collaborating with more than 20 alert-receiving groups, and improving the D&R tools and pipelines used internally. The job also covers adding new log sources, automating response runbooks, and designing and maintaining detection coverage for both cloud and bare-metal environments.
Threat intelligence is applied to detection logic and response playbooks, with attention to attacker techniques that matter for cloud infrastructure. The engineer takes part in complex incident handling from scoping and containment through root cause analysis, helps define and report metrics such as mean time to detect and mean time to respond, and builds tooling, runbooks and on-call procedures that can grow with the company.
The best-suited person brings six or more years of experience spread across incident handling, detection engineering and security operations, along with practical work in cloud-native systems.
Responsibilities
- Create detections with minimal false positives and false negatives
- Work with more than 20 teams that rely on alerts to keep signal strong
- Design and operate detection coverage across cloud and bare-metal systems
- Expand internal D&R tooling and pipelines, including onboarding new logs
- Build and automate response runbooks
- Bring threat intel into detection logic and incident playbooks
- Take part in incident response, including scoping, containment, root cause analysis and retrospectives
- Partner with compliance and engineering to catch genuine threats while meeting regulatory needs
- Define and report D&R metrics including MTTD, MTTR, coverage and false-positive rates
- Help maintain the incident response program, including its processes and tools
- Build scalable tools, runbooks and on-call procedures
Requirements
- Six or more years across incident handling, detection engineering and security operations
- Practical experience with Kubernetes, Linux workloads and container-based infrastructure
- Strong detection engineering: writing and tuning rules in SIEMs such as Chronicle, Splunk or Elastic, and using SQL
- Experience building or running SOAR workflows that automate response at scale
- Working knowledge of MITRE ATT&CK, Pyramid of Pain and the Kill Chain
- Solid incident response basics: memory forensics, reviewing logs, examining network flows and writing up incidents afterward
- Stakeholder coordination with engineers, compliance, legal and executives during active incidents
- Ownership of complex changes that come out of post-mortems
Qualifications
- Golang and Temporal skills, ideally used for SOAR automation
- Experience with threats affecting AI/ML and GPU clusters
- Familiarity with eBPF detection or runtime security tools such as Falco or Tetragon
- Background in threat hunting
Core Skills
Benefits
- Competitive pay
- Growth and learning opportunities
- Flexibility and personal ownership
- Collaborative, inventive culture
- Chances to work on meaningful AI projects
- International setting with talented colleagues
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is the role remote?
Yes. The listing shows the role as remote, and Nebius describes a flexible, remote-first culture.
What is the hiring process?
The steps are a 30-minute recruiter chat, a 60-minute live coding round covering basic coding, a 60-minute security interview, a 90-minute incident response interview and a 45-minute final interview.
What experience does the role require?
The posting asks for six or more years across incident handling, detection engineering and security operations, with practical experience in cloud-native environments.
Is a salary stated?
The posting does not give a figure. It describes competitive compensation.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
