Remote opportunity at
NebiusDetection & Response Lead
Nebius is looking for a Detection and Response Lead to build the detection and incident response function for Nebius Cloud from the ground up. The role…
Career Tools
About This Role
Nebius is looking for a Detection and Response Lead to build the detection and incident response function for Nebius Cloud from the ground up. The role is remote and full-time. Nebius is an AI cloud provider listed on Nasdaq under NBIS and headquartered in Amsterdam, with research and development hubs in Europe, the United Kingdom, North America and Israel. The group handles detection work, threat intelligence and incident handling across…
Job Description
Nebius is looking for a Detection and Response Lead to build the detection and incident response function for Nebius Cloud from the ground up. The role is remote and full-time. Nebius is an AI cloud provider listed on Nasdaq under NBIS and headquartered in Amsterdam, with research and development hubs in Europe, the United Kingdom, North America and Israel.
The group handles detection work, threat intelligence and incident handling across the cloud. The lead owns these areas, guides a small team that is still growing, and personally takes on the hardest security incidents, forensic work and the overall direction of detection and response. Core tasks include writing detections that keep false positives and false negatives low, serving more than 20 teams that receive alerts, and extending internal tooling and data pipelines.
The lead also feeds threat intelligence into detection content and response playbooks, drives incidents from scoping through root cause analysis and retrospectives, and sets measures such as mean time to detect, mean time to respond and detection coverage. The position includes building the company's incident response program, covering people, processes and tooling.
The ideal candidate is a senior security practitioner whose background spans incident handling, detection engineering and security operations over six or more years, including one to two years of leading or coaching a team.
Responsibilities
- Build detections that keep alert noise low while catching real threats
- Maintain alert quality for more than 20 consuming teams
- Plan and run detection coverage across cloud and bare-metal systems
- Develop internal D&R tooling and pipelines, including onboarding new log sources
- Create and automate response runbooks
- Map adversary techniques relevant to cloud infrastructure into detections and playbooks
- Direct incident response from scoping and containment through root cause work and follow-up
- Coordinate with compliance and engineering to spot threats while meeting regulatory requirements
- Track and report MTTD, MTTR, detection coverage and false-positive rates
- Design tools, runbooks and on-call procedures that scale with growth
Requirements
- Six or more years across incident handling, detection engineering and security operations, with one to two years leading or mentoring
- Practical experience with cloud-native platforms such as Kubernetes, Linux workloads and containerized infrastructure
- Solid detection engineering: writing and refining rules in SIEMs such as Chronicle, Splunk or Elastic, plus SQL
- Experience building or running SOAR workflows and automating responses at scale
- Working knowledge of MITRE ATT&CK, Pyramid of Pain and Kill Chain models and how to apply them
- Core IR skills: memory forensics, reviewing logs, examining packets and network flows, and writing up incidents afterward
- Ability to manage stakeholders such as engineers, compliance staff, lawyers and executives during live incidents
- Primary ownership of complex changes arising from post-mortems
Qualifications
- Golang and Temporal experience, ideally applied to SOAR automation
- Familiarity with threats to AI/ML workloads and GPU clusters
- Knowledge of eBPF-based detection or runtime tools such as Falco or Tetragon
- Threat hunting background
Core Skills
Benefits
- Pay that is competitive, with equity upside
- Opportunities for career advancement and learning
- Autonomy and accountability in the role
- A collaborative, creative culture
- Work on AI initiatives with real impact
- A global setting with strong teams
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is the role remote?
Yes. The listing shows the role as remote, and Nebius describes a flexible, remote-first culture.
What is the hiring process?
The steps are a 30-minute recruiter chat, a 60-minute live coding interview, a 60-minute security interview, a 90-minute incident response interview and a 45-minute final interview. An optional 90-minute technical deep dive on a past project may also be part of the process.
What experience does the role require?
The posting asks for six or more years across incident handling, detection engineering and security operations, with one to two years of experience leading or mentoring.
Is a salary stated?
The posting does not give a figure. It describes competitive compensation with equity upside.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
